create_access_grant ¶

def create_access_grant(
    self,
    domain_id: "capo_cloudwatchomni.types.domain_id.DomainId",
    space_id: "capo_cloudwatchomni.types.space_id.SpaceId",
    name: str,
    principal: "capo_cloudwatchomni.types.access_grant_principal.AccessGrantPrincipal",
    permission: "capo_cloudwatchomni.types.access_grant_permission.AccessGrantPermission",
    *,
    config_overrides: Optional[CloudWatchOmniClientConfig] = None,
    scoped_actions: Optional[
        "capo_cloudwatchomni.types.scoped_actions_list.ScopedActionsList"
    ] = None,
    tags: Optional["capo_cloudwatchomni.types.tag_map.TagMap"] = None,
    client_token: Optional[
        "capo_cloudwatchomni.types.client_token.ClientToken"
    ] = None,
) -> "capo_cloudwatchomni.types.create_access_grant_output.CreateAccessGrantOutput":
    """Creates an AccessGrant that authorizes a principal to perform a set of actions on resources in a space. Optionally narrow the grant with scoped actions that limit it to specific resources and fields. Use ListAccessGrants and GetAccessGrant to retrieve grants, and DeleteAccessGrant to remove them.

    Args:
        domain_id: The ID of the domain that contains the space.
        space_id: The ID of the space to scope the grant to.
        name: A name that identifies the access grant.
        principal: The principal receiving the grant.
        permission: The permission to grant. Exactly one permission is granted per request.
        scoped_actions: Groups of actions to allow, each with the resource scopes and conditions that limit those actions.
        tags: The tags to associate with the access grant.
        client_token: Idempotency token for safe retries. Repeated requests with the same token return the original result instead of creating a duplicate.

    Raises:
        capo_cloudwatchomni.errors.access_denied_exception.AccessDeniedException: The caller is not authorized to perform this action.
        capo_cloudwatchomni.errors.conflict_exception.ConflictException: The operation could not be completed because of a conflict with the current state of the resource.
        capo_cloudwatchomni.errors.internal_server_exception.InternalServerException: An unexpected error occurred while processing the request.
        capo_cloudwatchomni.errors.resource_not_found_exception.ResourceNotFoundException: The specified resource does not exist.
        capo_cloudwatchomni.errors.service_quota_exceeded_exception.ServiceQuotaExceededException: A service quota was exceeded.
        capo_cloudwatchomni.errors.throttling_exception.ThrottlingException: The request was throttled due to exceeding the allowed request rate.
        capo_cloudwatchomni.errors.validation_exception.ValidationException: A parameter is specified incorrectly.
        capo_cloudwatchomni.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        Create an access grant
        The following example creates a custom access grant that authorizes an Identity Center user to read and update a specific dashboard in a space. Payloads are shown as JSON; on the wire they are CBOR-encoded.

        >>> client.create_access_grant(domain_id='d-1a2b3c4d5e', space_id='a1b2c3d4-5e6f-4a3b-8c9d-0e1f2a3b4c5d', name='analyst-read-access', principal={'principalType': 'IDC_USER', 'principalId': '94b6c7d8-1a2b-4c3d-9e4f-5a6b7c8d9e0f'}, permission='CUSTOM', scoped_actions=[{'actions': ['cloudwatch:GetOmniDashboard', 'cloudwatch:UpdateOmniDashboard'], 'resources': [{'resourceType': 'OmniDashboard', 'resourceArns': ['arn:aws:cloudwatch:us-east-1:123456789012:omni-dashboard/c3d4e5f6-7a8b-4c9d-8e0f-1a2b3c4d5e6f']}]}], tags={'Team': 'observability'}, client_token='3f2a9c1e-7b04-4d8a-9e15-6c2b8d0f4a73')
    """

    def _handler(
        req: "OperationRequest[capo_cloudwatchomni.types.create_access_grant_input.CreateAccessGrantInput]",
    ) -> OperationResponse[
        "capo_cloudwatchomni.types.create_access_grant_output.CreateAccessGrantOutput"
    ]:
        import capo_cloudwatchomni._operations.cloud_watch_omni_frontend.create_access_grant

        output, http_response = (
            capo_cloudwatchomni._operations.cloud_watch_omni_frontend.create_access_grant.create_access_grant(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateAccessGrant")
    )
    input_: capo_cloudwatchomni.types.create_access_grant_input.CreateAccessGrantInput = {
        "domain_id": domain_id,
        "space_id": space_id,
        "name": name,
        "principal": principal,
        "permission": permission,
    }
    if scoped_actions is not None:
        input_["scoped_actions"] = scoped_actions
    if tags is not None:
        input_["tags"] = tags
    if client_token is None:
        client_token = str(uuid.uuid4())
    input_["client_token"] = client_token

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output