Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by GrantScope, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the AllowedByApplication filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (ALL). For more information, see List the caller's access grants in the Amazon S3 User Guide.
- Permissions
-
You must have the s3:ListCallerAccessGrants permission to use this operation.
Parameters:
-
account_id
(AccountId)
–
The Amazon Web Services account ID of the S3 Access Grants instance.
-
grant_scope
(Optional[S3Prefix], default:
None
)
–
The S3 path of the data that you would like to access. Must start with s3://. You can optionally pass only the beginning characters of a path, and S3 Access Grants will search for all applicable grants for the path fragment.
-
next_token
(Optional[ContinuationToken], default:
None
)
–
A pagination token to request the next page of results. Pass this value into a subsequent List Caller Access Grants request in order to retrieve the next page of results.
-
max_results
(Optional[MaxResults], default:
None
)
–
The maximum number of access grants that you would like returned in the List Caller Access Grants response. If the results include the pagination token NextToken, make another call using the NextToken to determine if there are more results.
-
allowed_by_application
(Optional[Boolean], default:
None
)
–
If this optional parameter is passed in the request, a filter is applied to the results. The results will include only the access grants for the caller's Identity Center application or for any other applications (ALL).
Raises:
Source code in docs_src/capo_s3_control/_services/async_s3_control.py
| async def list_caller_access_grants(
self,
account_id: "capo_s3_control.types.account_id.AccountId",
*,
config_overrides: Optional[AsyncS3ControlClientConfig] = None,
grant_scope: Optional["capo_s3_control.types.s3_prefix.S3Prefix"] = None,
next_token: Optional[
"capo_s3_control.types.continuation_token.ContinuationToken"
] = None,
max_results: Optional["capo_s3_control.types.max_results.MaxResults"] = None,
allowed_by_application: Optional[
"capo_s3_control.types.boolean.Boolean"
] = None,
) -> "capo_s3_control.types.list_caller_access_grants_result.ListCallerAccessGrantsResult":
"""<p>Use this API to list the access grants that grant the caller access to Amazon S3 data through S3 Access Grants. The caller (grantee) can be an Identity and Access Management (IAM) identity or Amazon Web Services Identity Center corporate directory identity. You must pass the Amazon Web Services account of the S3 data owner (grantor) in the request. You can, optionally, narrow the results by <code>GrantScope</code>, using a fragment of the data's S3 path, and S3 Access Grants will return only the grants with a path that contains the path fragment. You can also pass the <code>AllowedByApplication</code> filter in the request, which returns only the grants authorized for applications, whether the application is the caller's Identity Center application or any other application (<code>ALL</code>). For more information, see <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-list-grants.html">List the caller's access grants</a> in the <i>Amazon S3 User Guide</i>.</p> <dl> <dt>Permissions</dt> <dd> <p>You must have the <code>s3:ListCallerAccessGrants</code> permission to use this operation. </p> </dd> </dl>
Args:
account_id: <p>The Amazon Web Services account ID of the S3 Access Grants instance.</p>
grant_scope: <p>The S3 path of the data that you would like to access. Must start with <code>s3://</code>. You can optionally pass only the beginning characters of a path, and S3 Access Grants will search for all applicable grants for the path fragment. </p>
next_token: <p>A pagination token to request the next page of results. Pass this value into a subsequent <code>List Caller Access Grants</code> request in order to retrieve the next page of results.</p>
max_results: <p>The maximum number of access grants that you would like returned in the <code>List Caller Access Grants</code> response. If the results include the pagination token <code>NextToken</code>, make another call using the <code>NextToken</code> to determine if there are more results.</p>
allowed_by_application: <p>If this optional parameter is passed in the request, a filter is applied to the results. The results will include only the access grants for the caller's Identity Center application or for any other applications (<code>ALL</code>).</p>
Raises:
capo_s3_control.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
async def _handler(
req: "AsyncOperationRequest[capo_s3_control.types.list_caller_access_grants_request.ListCallerAccessGrantsRequest]",
) -> AsyncOperationResponse[
"capo_s3_control.types.list_caller_access_grants_result.ListCallerAccessGrantsResult"
]:
import capo_s3_control._operations.awss3_control_service_v20180820.list_caller_access_grants
(
output,
http_response,
) = await capo_s3_control._operations.awss3_control_service_v20180820.list_caller_access_grants.async_list_caller_access_grants(
req.options, req.input
)
return AsyncOperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("ListCallerAccessGrants")
)
input_: capo_s3_control.types.list_caller_access_grants_request.ListCallerAccessGrantsRequest = {
"account_id": account_id
}
if grant_scope is not None:
input_["grant_scope"] = grant_scope
if next_token is not None:
input_["next_token"] = next_token
if max_results is not None:
input_["max_results"] = max_results
if allowed_by_application is not None:
input_["allowed_by_application"] = allowed_by_application
response = await aexecute_pipeline(
AsyncOperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
await response.response.aclose()
return response.output
|