list_permissions ¶

def list_permissions(
    self,
    certificate_authority_arn: "capo_acm_pca.types.arn.Arn",
    *,
    config_overrides: Optional[ACMPCAClientConfig] = None,
    max_results: Optional["capo_acm_pca.types.max_results.MaxResults"] = None,
    next_token: Optional["capo_acm_pca.types.next_token.NextToken"] = None,
) -> "capo_acm_pca.types.list_permissions_response.ListPermissionsResponse":
    """<p>List all permissions on a private CA, if any, granted to the Certificate Manager (ACM) service principal (acm.amazonaws.com). </p> <p>These permissions allow ACM to issue and renew ACM certificates that reside in the same Amazon Web Services account as the CA. </p> <p>Permissions can be granted with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreatePermission.html">CreatePermission</a> action and revoked with the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html">DeletePermission</a> action.</p> <p class="title"> <b>About Permissions</b> </p> <ul> <li> <p>If the private CA and the certificates it issues reside in the same account, you can use <code>CreatePermission</code> to grant permissions for ACM to carry out automatic certificate renewals.</p> </li> <li> <p>For automatic certificate renewal to succeed, the ACM service principal needs permissions to create, retrieve, and list certificates.</p> </li> <li> <p>If the private CA and the ACM certificates reside in different accounts, then permissions cannot be used to enable automatic renewals. Instead, the ACM certificate owner must set up a resource-based policy to enable cross-account issuance and renewals. For more information, see <a href="https://docs.aws.amazon.com/privateca/latest/userguide/pca-rbp.html">Using a Resource Based Policy with Amazon Web Services Private CA</a>.</p> </li> </ul>

    Args:
        max_results: <p>When paginating results, use this parameter to specify the maximum number of items to return in the response. If additional items exist beyond the number you specify, the <b>NextToken</b> element is sent in the response. Use this <b>NextToken</b> value in a subsequent request to retrieve additional items.</p>
        next_token: <p>When paginating results, use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of <b>NextToken</b> from the response you just received.</p>
        certificate_authority_arn: <p>The Amazon Resource Number (ARN) of the private CA to inspect. You can find the ARN by calling the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action. This must be of the form: <code>arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012</code> You can get a private CA's ARN by running the <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a> action.</p>

    Raises:
        capo_acm_pca.errors.invalid_arn_exception.InvalidArnException: <p>The requested Amazon Resource Name (ARN) does not refer to an existing resource.</p>
        capo_acm_pca.errors.invalid_next_token_exception.InvalidNextTokenException: <p>The token specified in the <code>NextToken</code> argument is not valid. Use the token returned from your previous call to <a href="https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html">ListCertificateAuthorities</a>.</p>
        capo_acm_pca.errors.invalid_state_exception.InvalidStateException: <p>The state of the private CA does not allow this action to occur.</p>
        capo_acm_pca.errors.request_failed_exception.RequestFailedException: <p>The request has failed for an unspecified reason.</p>
        capo_acm_pca.errors.resource_not_found_exception.ResourceNotFoundException: <p>A resource such as a private CA, S3 bucket, certificate, audit report, or policy cannot be found.</p>
        capo_acm_pca.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_acm_pca.types.list_permissions_request.ListPermissionsRequest]",
    ) -> OperationResponse[
        "capo_acm_pca.types.list_permissions_response.ListPermissionsResponse"
    ]:
        import capo_acm_pca._operations.acm_private_ca.list_permissions

        output, http_response = (
            capo_acm_pca._operations.acm_private_ca.list_permissions.list_permissions(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("ListPermissions")
    )
    input_: capo_acm_pca.types.list_permissions_request.ListPermissionsRequest = {
        "certificate_authority_arn": certificate_authority_arn
    }
    if max_results is not None:
        input_["max_results"] = max_results
    if next_token is not None:
        input_["next_token"] = next_token

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output