create_permission ¶

def create_permission(
    self,
    certificate_authority_arn: "capo_acm_pca.types.arn.Arn",
    principal: "capo_acm_pca.types.principal.Principal",
    actions: "capo_acm_pca.types.action_list.ActionList",
    *,
    config_overrides: Optional[ACMPCAClientConfig] = None,
    source_account: Optional["capo_acm_pca.types.account_id.AccountId"] = None,
) -> None:
    """<p>Grants one or more permissions on a private CA to the Certificate Manager (ACM) service principal (<code>acm.amazonaws.com</code>). These permissions allow ACM to issue and renew ACM certificates that reside in the same Amazon Web Services account as the CA.</p> <p>You can list current permissions with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html">ListPermissions</a> action and revoke them with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html">DeletePermission</a> action.</p> <p class="title"> <b>About Permissions</b> </p> <ul> <li> <p>If the private CA and the certificates it issues reside in the same account, you can use <code>CreatePermission</code> to grant permissions for ACM to carry out automatic certificate renewals.</p> </li> <li> <p>For automatic certificate renewal to succeed, the ACM service principal needs permissions to create, retrieve, and list certificates.</p> </li> <li> <p>If the private CA and the ACM certificates reside in different accounts, then permissions cannot be used to enable automatic renewals. Instead, the ACM certificate owner must set up a resource-based policy to enable cross-account issuance and renewals. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html">Using a Resource Based Policy with Amazon Web Services Private CA</a>.</p> </li> </ul>

    Args:
        certificate_authority_arn: <p>The Amazon Resource Name (ARN) of the CA that grants the permissions. You can find the ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must have the following form: </p> <p> <code>arn:aws:acm-pca:<i>region</i>:<i>account</i>:certificate-authority/<i>12345678-1234-1234-1234-123456789012</i> </code>. </p>
        principal: <p>The Amazon Web Services service or identity that receives the permission. At this time, the only valid principal is <code>acm.amazonaws.com</code>.</p>
        source_account: <p>The ID of the calling account.</p>
        actions: <p>The actions that the specified Amazon Web Services service principal can use. These include <code>IssueCertificate</code>, <code>GetCertificate</code>, and <code>ListPermissions</code>.</p>

    Raises:
        capo_acm_pca.errors.invalid_arn_exception.InvalidArnException: <p>The requested Amazon Resource Name (ARN) does not refer to an existing resource.</p>
        capo_acm_pca.errors.invalid_state_exception.InvalidStateException: <p>The state of the private CA does not allow this action to occur.</p>
        capo_acm_pca.errors.limit_exceeded_exception.LimitExceededException: <p>An Amazon Web Services Private CA quota has been exceeded. See the exception message returned to determine the quota that was exceeded.</p>
        capo_acm_pca.errors.permission_already_exists_exception.PermissionAlreadyExistsException: <p>The designated permission has already been given to the user.</p>
        capo_acm_pca.errors.request_failed_exception.RequestFailedException: <p>The request has failed for an unspecified reason.</p>
        capo_acm_pca.errors.resource_not_found_exception.ResourceNotFoundException: <p>A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.</p>
        capo_acm_pca.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_acm_pca.types.create_permission_request.CreatePermissionRequest]",
    ) -> OperationResponse[None]:
        import capo_acm_pca._operations.acm_private_ca.create_permission

        output, http_response = (
            capo_acm_pca._operations.acm_private_ca.create_permission.create_permission(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreatePermission")
    )
    input_: capo_acm_pca.types.create_permission_request.CreatePermissionRequest = {
        "certificate_authority_arn": certificate_authority_arn,
        "principal": principal,
        "actions": actions,
    }
    if source_account is not None:
        input_["source_account"] = source_account

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output