CreateMembers is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses CreateMembers to enable organization accounts as member accounts.
For invited accounts, CreateMembers sends a request to invite the specified Amazon Web Services accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph.
CreateMembers verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally.
For organization accounts in the organization behavior graph, CreateMembers attempts to enable the accounts. The organization accounts do not receive invitations.
The request provides the behavior graph ARN and the list of accounts to invite or to enable.
The response separates the requested accounts into two lists:
-
The accounts that CreateMembers was able to process. For invited accounts, includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification. For organization accounts in the organization behavior graph, includes accounts that can be enabled and that cannot be enabled.
-
The accounts that CreateMembers was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.
Parameters:
-
graph_arn
(GraphArn)
–
The ARN of the behavior graph.
-
message
(Optional[EmailMessage], default:
None
)
–
Customized message text to include in the invitation email message to the invited member accounts.
-
disable_email_notification
(Optional[Boolean], default:
None
)
–
if set to true, then the invited accounts do not receive email notifications. By default, this is set to false, and the invited accounts receive email notifications.
Organization accounts in the organization behavior graph do not receive email notifications.
-
accounts
(AccountList)
–
The list of Amazon Web Services accounts to invite or to enable. You can invite or enable up to 50 accounts at a time. For each invited account, the account list contains the account identifier and the Amazon Web Services account root user email address. For organization accounts in the organization behavior graph, the email address is not required.
Raises:
-
AccessDeniedException
–
The request issuer does not have permission to access this resource or perform this operation.
-
InternalServerException
–
The request was valid but failed because of a problem with the service.
-
ResourceNotFoundException
–
The request refers to a nonexistent resource.
-
ServiceQuotaExceededException
–
This request cannot be completed for one of the following reasons.
-
This request cannot be completed if it would cause the number of member accounts in the behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200 member accounts.
-
This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.
-
ValidationException
–
The request parameters are invalid.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_detective/_services/async_detective.py
| async def create_members(
self,
graph_arn: "capo_detective.types.graph_arn.GraphArn",
accounts: "capo_detective.types.account_list.AccountList",
*,
config_overrides: Optional[AsyncDetectiveClientConfig] = None,
message: Optional["capo_detective.types.email_message.EmailMessage"] = None,
disable_email_notification: Optional[
"capo_detective.types.boolean.Boolean"
] = None,
) -> "capo_detective.types.create_members_response.CreateMembersResponse":
"""<p> <code>CreateMembers</code> is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses <code>CreateMembers</code> to enable organization accounts as member accounts.</p> <p>For invited accounts, <code>CreateMembers</code> sends a request to invite the specified Amazon Web Services accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph. </p> <p> <code>CreateMembers</code> verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally.</p> <p>For organization accounts in the organization behavior graph, <code>CreateMembers</code> attempts to enable the accounts. The organization accounts do not receive invitations.</p> <p>The request provides the behavior graph ARN and the list of accounts to invite or to enable.</p> <p>The response separates the requested accounts into two lists:</p> <ul> <li> <p>The accounts that <code>CreateMembers</code> was able to process. For invited accounts, includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification. For organization accounts in the organization behavior graph, includes accounts that can be enabled and that cannot be enabled.</p> </li> <li> <p>The accounts that <code>CreateMembers</code> was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.</p> </li> </ul>
Args:
graph_arn: <p>The ARN of the behavior graph.</p>
message: <p>Customized message text to include in the invitation email message to the invited member accounts.</p>
disable_email_notification: <p>if set to <code>true</code>, then the invited accounts do not receive email notifications. By default, this is set to <code>false</code>, and the invited accounts receive email notifications.</p> <p>Organization accounts in the organization behavior graph do not receive email notifications.</p>
accounts: <p>The list of Amazon Web Services accounts to invite or to enable. You can invite or enable up to 50 accounts at a time. For each invited account, the account list contains the account identifier and the Amazon Web Services account root user email address. For organization accounts in the organization behavior graph, the email address is not required.</p>
Raises:
capo_detective.errors.access_denied_exception.AccessDeniedException: <p>The request issuer does not have permission to access this resource or perform this operation.</p>
capo_detective.errors.internal_server_exception.InternalServerException: <p>The request was valid but failed because of a problem with the service.</p>
capo_detective.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request refers to a nonexistent resource.</p>
capo_detective.errors.service_quota_exceeded_exception.ServiceQuotaExceededException: <p>This request cannot be completed for one of the following reasons.</p> <ul> <li> <p>This request cannot be completed if it would cause the number of member accounts in the behavior graph to exceed the maximum allowed. A behavior graph cannot have more than 1,200 member accounts.</p> </li> <li> <p>This request cannot be completed if the current volume ingested is above the limit of 10 TB per day. Detective will not allow you to add additional member accounts.</p> </li> </ul>
capo_detective.errors.validation_exception.ValidationException: <p>The request parameters are invalid.</p>
capo_detective.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
async def _handler(
req: "AsyncOperationRequest[capo_detective.types.create_members_request.CreateMembersRequest]",
) -> AsyncOperationResponse[
"capo_detective.types.create_members_response.CreateMembersResponse"
]:
import capo_detective._operations.amazon_detective.create_members
(
output,
http_response,
) = await capo_detective._operations.amazon_detective.create_members.async_create_members(
req.options, req.input
)
return AsyncOperationResponse(output=output, response=http_response)
def _redact_input(
input_: "capo_detective.types.create_members_request.CreateMembersRequest",
) -> dict[str, Any]:
import capo_detective.types.create_members_request
return capo_detective.types.create_members_request.redact_sensitive(input_)
def _redact_output(
output: "capo_detective.types.create_members_response.CreateMembersResponse",
) -> dict[str, Any]:
import capo_detective.types.create_members_response
return capo_detective.types.create_members_response.redact_sensitive(output)
interceptors_, options_ = self.operation_options(
config_overrides,
OperationLogging(
"CreateMembers",
redact_input=_redact_input,
redact_output=_redact_output,
),
)
input_: capo_detective.types.create_members_request.CreateMembersRequest = {
"graph_arn": graph_arn,
"accounts": accounts,
}
if message is not None:
input_["message"] = message
if disable_email_notification is not None:
input_["disable_email_notification"] = disable_email_notification
response = await aexecute_pipeline(
AsyncOperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
await response.response.aclose()
return response.output
|