transfer_certificate ¶

def transfer_certificate(
    self,
    certificate_id: "capo_iot.types.certificate_id.CertificateId",
    target_aws_account: "capo_iot.types.aws_account_id.AwsAccountId",
    *,
    config_overrides: Optional[IoTClientConfig] = None,
    transfer_message: Optional["capo_iot.types.message.Message"] = None,
) -> "capo_iot.types.transfer_certificate_response.TransferCertificateResponse":
    """<p>Transfers the specified certificate to the specified Amazon Web Services account.</p> <p>Requires permission to access the <a href="https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions">TransferCertificate</a> action.</p> <p>You can cancel the transfer until it is accepted by the recipient.</p> <p>No notification is sent to the transfer destination's account. The caller is responsible for notifying the transfer target.</p> <p>The certificate being transferred must not be in the <code>ACTIVE</code> state. You can use the <a>UpdateCertificate</a> action to deactivate it.</p> <p>The certificate must not have any policies attached to it. You can use the <a>DetachPolicy</a> action to detach them.</p> <p> <b>Customer managed key behavior:</b> When you use a customer managed key to encrypt your data and then transfer the certificate to a customer in a different account using the <code>TransferCertificate</code> operation, the certificates will no longer be encrypted by their customer managed key configuration. During the transfer process, certificates are encrypted using Amazon Web Services IoT Core owned keys.</p> <p>While a certificate is in the <b>PENDING_TRANSFER</b> state, it's always protected by Amazon Web Services IoT Core owned keys, regardless of the customer managed key configuration of either the source or destination account. </p> <p>Once the transfer is completed through <a>AcceptCertificateTransfer</a>, <a>RejectCertificateTransfer</a>, or <a>CancelCertificateTransfer</a>, the certificate will be protected by the customer managed key configuration of the account that owns the certificate after the transfer operation:</p> <ul> <li> <p>If the transfer is accepted: The certificate is encrypted by the target account's customer managed key configuration.</p> </li> <li> <p>If the transfer is rejected or cancelled: The certificate is protected by the source account's customer managed key configuration.</p> </li> </ul>

    Args:
        certificate_id: <p>The ID of the certificate. (The last part of the certificate ARN contains the certificate ID.)</p>
        target_aws_account: <p>The Amazon Web Services account.</p>
        transfer_message: <p>The transfer message.</p>

    Raises:
        capo_iot.errors.certificate_state_exception.CertificateStateException: <p>The certificate operation is not allowed.</p>
        capo_iot.errors.internal_failure_exception.InternalFailureException: <p>An unexpected error has occurred.</p>
        capo_iot.errors.invalid_request_exception.InvalidRequestException: <p>The request is not valid.</p>
        capo_iot.errors.resource_not_found_exception.ResourceNotFoundException: <p>The specified resource does not exist.</p>
        capo_iot.errors.service_unavailable_exception.ServiceUnavailableException: <p>The service is temporarily unavailable.</p>
        capo_iot.errors.throttling_exception.ThrottlingException: <p>The rate exceeds the limit.</p>
        capo_iot.errors.transfer_conflict_exception.TransferConflictException: <p>You can't transfer the certificate because authorization policies are still attached.</p>
        capo_iot.errors.unauthorized_exception.UnauthorizedException: <p>You are not authorized to perform this operation.</p>
        capo_iot.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_iot.types.transfer_certificate_request.TransferCertificateRequest]",
    ) -> OperationResponse[
        "capo_iot.types.transfer_certificate_response.TransferCertificateResponse"
    ]:
        import capo_iot._operations.aws_iot_service.transfer_certificate

        output, http_response = (
            capo_iot._operations.aws_iot_service.transfer_certificate.transfer_certificate(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("TransferCertificate")
    )
    input_: capo_iot.types.transfer_certificate_request.TransferCertificateRequest = {
        "certificate_id": certificate_id,
        "target_aws_account": target_aws_account,
    }
    if transfer_message is not None:
        input_["transfer_message"] = transfer_message

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output