create_role async ¶

async def create_role(
    self,
    role_name: "capo_iam.types.role_name_type.roleNameType",
    assume_role_policy_document: "capo_iam.types.policy_document_type.policyDocumentType",
    *,
    config_overrides: Optional[AsyncIAMClientConfig] = None,
    path: Optional["capo_iam.types.path_type.pathType"] = None,
    description: Optional[
        "capo_iam.types.role_description_type.roleDescriptionType"
    ] = None,
    max_session_duration: Optional[
        "capo_iam.types.role_max_session_duration_type.roleMaxSessionDurationType"
    ] = None,
    permissions_boundary: Optional["capo_iam.types.arn_type.arnType"] = None,
    tags: Optional["capo_iam.types.tag_list_type.tagListType"] = None,
) -> "capo_iam.types.create_role_response.CreateRoleResponse":
    r"""<p>Creates a new role for your Amazon Web Services account.</p> <p> For more information about roles, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html">IAM roles</a> in the <i>IAM User Guide</i>. For information about quotas for role names and the number of roles you can create, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html">IAM and STS quotas</a> in the <i>IAM User Guide</i>.</p>

    Args:
        path: <p> The path to the role. For more information about paths, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html">IAM Identifiers</a> in the <i>IAM User Guide</i>.</p> <p>This parameter is optional. If it is not included, it defaults to a slash (/).</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (<code>\u0021</code>) through the DEL character (<code>\u007F</code>), including most punctuation characters, digits, and upper and lowercased letters.</p>
        role_name: <p>The name of the role to create.</p> <p>IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>
        assume_role_policy_document: <p>The trust relationship policy document that grants an entity permission to assume the role.</p> <p>In IAM, you must provide a JSON policy that has been converted to a string. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.</p> <p>The <a href="http://wikipedia.org/wiki/regex">regex pattern</a> used to validate this parameter is a string of characters consisting of the following:</p> <ul> <li> <p>Any printable ASCII character ranging from the space character (<code>\u0020</code>) through the end of the ASCII character range</p> </li> <li> <p>The printable characters in the Basic Latin and Latin-1 Supplement character set (through <code>\u00FF</code>)</p> </li> <li> <p>The special characters tab (<code>\u0009</code>), line feed (<code>\u000A</code>), and carriage return (<code>\u000D</code>)</p> </li> </ul> <p> Upon success, the response includes the same trust policy in JSON format.</p>
        description: <p>A description of the role.</p>
        max_session_duration: <p>The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.</p> <p>Anyone who assumes the role from the CLI or API can use the <code>DurationSeconds</code> API parameter or the <code>duration-seconds</code> CLI parameter to request a longer session. The <code>MaxSessionDuration</code> setting determines the maximum duration that can be requested using the <code>DurationSeconds</code> parameter. If users don't specify a value for the <code>DurationSeconds</code> parameter, their security credentials are valid for one hour by default. This applies when you use the <code>AssumeRole*</code> API operations or the <code>assume-role*</code> CLI operations but does not apply when you use those operations to create a console URL. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using IAM roles</a> in the <i>IAM User Guide</i>.</p>
        permissions_boundary: <p>The ARN of the managed policy that is used to set the permissions boundary for the role.</p> <p>A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html">Permissions boundaries for IAM entities</a> in the <i>IAM User Guide</i>.</p> <p>For more information about policy types, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types">Policy types </a> in the <i>IAM User Guide</i>.</p>
        tags: <p>A list of tags that you want to attach to the new role. Each tag consists of a key name and an associated value. For more information about tagging, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html">Tagging IAM resources</a> in the <i>IAM User Guide</i>.</p> <note> <p>If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.</p> </note>

    Raises:
        capo_iam.errors.concurrent_modification_exception.ConcurrentModificationException: <p>The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.</p>
        capo_iam.errors.entity_already_exists_exception.EntityAlreadyExistsException: <p>The request was rejected because it attempted to create a resource that already exists.</p>
        capo_iam.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because an invalid or out-of-range value was supplied for an input parameter.</p>
        capo_iam.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.</p>
        capo_iam.errors.malformed_policy_document_exception.MalformedPolicyDocumentException: <p>The request was rejected because the policy document was malformed. The error message describes the specific error.</p>
        capo_iam.errors.service_failure_exception.ServiceFailureException: <p>The request processing has failed because of an unknown error, exception or failure.</p>
        capo_iam.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To create an IAM role
        The following command creates a role named Test-Role and attaches a trust policy that you must convert from JSON to a string. Upon success, the response includes the same policy as a URL-encoded JSON string.

        >>> await client.create_role(assume_role_policy_document='<Stringified-JSON>', path='/', role_name='Test-Role')
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_iam.types.create_role_request.CreateRoleRequest]",
    ) -> AsyncOperationResponse[
        "capo_iam.types.create_role_response.CreateRoleResponse"
    ]:
        import capo_iam._operations.aws_identity_management_v20100508.create_role

        (
            output,
            http_response,
        ) = await capo_iam._operations.aws_identity_management_v20100508.create_role.async_create_role(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateRole")
    )
    input_: capo_iam.types.create_role_request.CreateRoleRequest = {
        "role_name": role_name,
        "assume_role_policy_document": assume_role_policy_document,
    }
    if path is not None:
        input_["path"] = path
    if description is not None:
        input_["description"] = description
    if max_session_duration is not None:
        input_["max_session_duration"] = max_session_duration
    if permissions_boundary is not None:
        input_["permissions_boundary"] = permissions_boundary
    if tags is not None:
        input_["tags"] = tags

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output