Module Smaws_Client_SSOAdmin.Types

type nonrec validation_exception_reason =
  1. | KMS_DISABLED_EXCEPTION
  2. | KMS_INVALID_STATE_EXCEPTION
  3. | KMS_INVALID_KEY_USAGE_EXCEPTION
type nonrec validation_exception_message = string
type nonrec validation_exception = {
  1. reason : validation_exception_reason option;
    (*

    The reason for the validation exception.

    *)
  2. message : validation_exception_message option;
}

The request failed because it contains a syntax error.

type nonrec user_background_session_application_status =
  1. | DISABLED
  2. | ENABLED
type nonrec update_trusted_token_issuer_response = unit
type nonrec trusted_token_issuer_arn = string
type nonrec trusted_token_issuer_name = string
type nonrec claim_attribute_path = string
type nonrec jmes_path = string
type nonrec jwks_retrieval_option =
  1. | OPEN_ID_DISCOVERY
type nonrec oidc_jwt_update_configuration = {
  1. jwks_retrieval_option : jwks_retrieval_option option;
    (*

    The method that the trusted token issuer can use to retrieve the JSON Web Key Set used to verify a JWT.

    *)
  2. identity_store_attribute_path : jmes_path option;
    (*

    The path of the destination attribute in a JWT from IAM Identity Center. The attribute mapped by this JMESPath expression is compared against the attribute mapped by ClaimAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.

    *)
  3. claim_attribute_path : claim_attribute_path option;
    (*

    The path of the source attribute in the JWT from the trusted token issuer. The attribute mapped by this JMESPath expression is compared against the attribute mapped by IdentityStoreAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.

    *)
}

A structure that describes updated configuration settings for a trusted token issuer that supports OpenID Connect (OIDC) and JSON Web Tokens (JWTs).

type nonrec trusted_token_issuer_update_configuration =
  1. | OidcJwtConfiguration of oidc_jwt_update_configuration
    (*

    A structure that describes an updated configuration for a trusted token issuer that uses OpenID Connect (OIDC) with JSON web tokens (JWT).

    *)

A structure that contains details to be updated for a trusted token issuer configuration. The structure and settings that you can include depend on the type of the trusted token issuer being updated.

type nonrec update_trusted_token_issuer_request = {
  1. trusted_token_issuer_configuration : trusted_token_issuer_update_configuration option;
    (*

    Specifies a structure with settings to apply to the specified trusted token issuer. The settings that you can provide are determined by the type of the trusted token issuer that you are updating.

    *)
  2. name : trusted_token_issuer_name option;
    (*

    Specifies the updated name to be applied to the trusted token issuer configuration.

    *)
  3. trusted_token_issuer_arn : trusted_token_issuer_arn;
    (*

    Specifies the ARN of the trusted token issuer configuration that you want to update.

    *)
}
type nonrec throttling_exception_message = string
type nonrec throttling_exception_reason =
  1. | KMS_THROTTLING_EXCEPTION
type nonrec throttling_exception = {
  1. reason : throttling_exception_reason option;
    (*

    The reason for the throttling exception.

    *)
  2. message : throttling_exception_message option;
}

Indicates that the principal has crossed the throttling limits of the API operations.

type nonrec resource_not_found_message = string
type nonrec resource_not_found_exception_reason =
  1. | KMS_NOT_FOUND_EXCEPTION
type nonrec resource_not_found_exception = {
  1. reason : resource_not_found_exception_reason option;
    (*

    The reason for the resource not found exception.

    *)
  2. message : resource_not_found_message option;
}

Indicates that a requested resource is not found.

type nonrec internal_failure_message = string
type nonrec internal_server_exception = {
  1. message : internal_failure_message option;
}

The request processing has failed because of an unknown error, exception, or failure with an internal server.

type nonrec conflict_exception_message = string
type nonrec conflict_exception = {
  1. message : conflict_exception_message option;
}

Occurs when a conflict with a previous successful write is detected. This generally occurs when the previous write did not have time to propagate to the host serving the current request. A retry (with appropriate backoff logic) is the recommended response to this exception.

type nonrec access_denied_exception_message = string
type nonrec access_denied_exception_reason =
  1. | KMS_ACCESS_DENIED_EXCEPTION
type nonrec access_denied_exception = {
  1. reason : access_denied_exception_reason option;
    (*

    The reason for the access denied exception.

    *)
  2. message : access_denied_exception_message option;
}

You do not have sufficient access to perform this action.

type nonrec update_permission_set_response = unit
type nonrec instance_arn = string
type nonrec permission_set_arn = string
type nonrec permission_set_description = string
type nonrec duration = string
type nonrec relay_state = string
type nonrec update_permission_set_request = {
  1. relay_state : relay_state option;
    (*

    Used to redirect users within the application during the federation authentication process.

    *)
  2. session_duration : duration option;
    (*

    The length of time that the application user sessions are valid for in the ISO-8601 standard.

    *)
  3. description : permission_set_description option;
    (*

    The description of the PermissionSet.

    *)
  4. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set.

    *)
  5. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec update_instance_response = unit
type nonrec name_type = string
type nonrec kms_key_type =
  1. | CUSTOMER_MANAGED_KEY
  2. | AWS_OWNED_KMS_KEY
type nonrec kms_key_arn = string
type nonrec encryption_configuration = {
  1. kms_key_arn : kms_key_arn option;
    (*

    The ARN of the KMS key used to encrypt data. Required when KeyType is CUSTOMER_MANAGED_KEY. Cannot be specified when KeyType is AWS_OWNED_KMS_KEY.

    *)
  2. key_type : kms_key_type;
    (*

    The type of KMS key used for encryption.

    *)
}

A structure that specifies the KMS key type and KMS key ARN used to encrypt data in your IAM Identity Center instance.

type nonrec update_instance_request = {
  1. encryption_configuration : encryption_configuration option;
    (*

    Specifies the encryption configuration for your IAM Identity Center instance. You can use this to configure customer managed KMS keys or Amazon Web Services owned KMS keys for encrypting your instance data.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  3. name : name_type option;
    (*

    Updates the instance name.

    *)
}
type nonrec update_instance_access_control_attribute_configuration_response = unit
type nonrec access_control_attribute_key = string
type nonrec access_control_attribute_value_source = string
type nonrec access_control_attribute_value_source_list = access_control_attribute_value_source list
type nonrec access_control_attribute_value = {
  1. source : access_control_attribute_value_source_list;
    (*

    The identity source to use when mapping a specified attribute to IAM Identity Center.

    *)
}

The value used for mapping a specified attribute to an identity source. For more information, see Attribute mappings in the IAM Identity Center User Guide.

type nonrec access_control_attribute = {
  1. value : access_control_attribute_value;
    (*

    The value used for mapping a specified attribute to an identity source.

    *)
  2. key : access_control_attribute_key;
    (*

    The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in IAM Identity Center.

    *)
}

These are IAM Identity Center identity store attributes that you can configure for use in attributes-based access control (ABAC). You can create permissions policies that determine who can access your Amazon Web Services resources based upon the configured attribute values. When you enable ABAC and specify AccessControlAttributes, IAM Identity Center passes the attribute values of the authenticated user into IAM for use in policy evaluation.

type nonrec access_control_attribute_list = access_control_attribute list
type nonrec instance_access_control_attribute_configuration = {
  1. access_control_attributes : access_control_attribute_list;
    (*

    Lists the attributes that are configured for ABAC in the specified IAM Identity Center instance.

    *)
}

Specifies the attributes to add to your attribute-based access control (ABAC) configuration.

type nonrec update_instance_access_control_attribute_configuration_request = {
  1. instance_access_control_attribute_configuration : instance_access_control_attribute_configuration;
    (*

    Updates the attributes for your ABAC configuration.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec update_application_response = unit
type nonrec application_arn = string
type nonrec application_name_type = string
type nonrec description = string
type nonrec application_status =
  1. | DISABLED
  2. | ENABLED
type nonrec sign_in_origin =
  1. | APPLICATION
  2. | IDENTITY_CENTER
type nonrec application_url = string
type nonrec sign_in_options = {
  1. application_url : application_url option;
    (*

    The URL that accepts authentication requests for an application. This is a required parameter if the Origin parameter is APPLICATION.

    *)
  2. origin : sign_in_origin;
    (*

    This determines how IAM Identity Center navigates the user to the target application. It can be one of the following values:

    • APPLICATION: IAM Identity Center redirects the customer to the configured ApplicationUrl.
    • IDENTITY_CENTER: IAM Identity Center uses SAML identity-provider initiated authentication to sign the customer directly into a SAML-based application.
    *)
}

A structure that describes the sign-in options for an application portal.

type nonrec update_application_portal_options = {
  1. sign_in_options : sign_in_options option;
}

A structure that describes the options for the access portal associated with an application that can be updated.

type nonrec update_application_request = {
  1. portal_options : update_application_portal_options option;
    (*

    A structure that describes the options for the portal associated with an application.

    *)
  2. status : application_status option;
    (*

    Specifies whether the application is enabled or disabled.

    *)
  3. description : description option;
    (*

    The description of the .

    *)
  4. name : application_name_type option;
    (*

    Specifies the updated name for the application.

    *)
  5. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec untag_resource_response = unit
type nonrec taggable_resource_arn = string
type nonrec tag_key = string
type nonrec tag_key_list = tag_key list
type nonrec untag_resource_request = {
  1. tag_keys : tag_key_list;
    (*

    The keys of tags that are attached to the resource.

    *)
  2. resource_arn : taggable_resource_arn;
    (*

    The ARN of the resource with the tags to be listed.

    *)
  3. instance_arn : instance_arn option;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec uu_id = string
type nonrec ur_i = string
type nonrec trusted_token_issuer_url = string
type nonrec trusted_token_issuer_type =
  1. | OIDC_JWT
type nonrec trusted_token_issuer_metadata = {
  1. trusted_token_issuer_type : trusted_token_issuer_type option;
    (*

    The type of trusted token issuer.

    *)
  2. name : trusted_token_issuer_name option;
    (*

    The name of the trusted token issuer configuration in the instance of IAM Identity Center.

    *)
  3. trusted_token_issuer_arn : trusted_token_issuer_arn option;
    (*

    The ARN of the trusted token issuer configuration in the instance of IAM Identity Center.

    *)
}

A structure that describes a trusted token issuer.

type nonrec trusted_token_issuer_list = trusted_token_issuer_metadata list
type nonrec oidc_jwt_configuration = {
  1. jwks_retrieval_option : jwks_retrieval_option;
    (*

    The method that the trusted token issuer can use to retrieve the JSON Web Key Set used to verify a JWT.

    *)
  2. identity_store_attribute_path : jmes_path;
    (*

    The path of the destination attribute in a JWT from IAM Identity Center. The attribute mapped by this JMESPath expression is compared against the attribute mapped by ClaimAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.

    *)
  3. claim_attribute_path : claim_attribute_path;
    (*

    The path of the source attribute in the JWT from the trusted token issuer. The attribute mapped by this JMESPath expression is compared against the attribute mapped by IdentityStoreAttributePath when a trusted token issuer token is exchanged for an IAM Identity Center token.

    *)
  4. issuer_url : trusted_token_issuer_url;
    (*

    The URL that IAM Identity Center uses for OpenID Discovery. OpenID Discovery is used to obtain the information required to verify the tokens that the trusted token issuer generates.

    *)
}

A structure that describes configuration settings for a trusted token issuer that supports OpenID Connect (OIDC) and JSON Web Tokens (JWTs).

type nonrec trusted_token_issuer_configuration =
  1. | OidcJwtConfiguration of oidc_jwt_configuration
    (*

    A structure that describes the settings for a trusted token issuer that works with OpenID Connect (OIDC) by using JSON Web Tokens (JWT).

    *)

A structure that describes the configuration of a trusted token issuer. The structure and available settings are determined by the type of the trusted token issuer.

type nonrec token_issuer_audience = string
type nonrec token_issuer_audiences = token_issuer_audience list
type nonrec token_exchange_grant = unit
type nonrec token = string
type nonrec target_type =
  1. | AWS_ACCOUNT
type nonrec target_id = string
type nonrec tag_value = string
type nonrec tag_resource_response = unit
type nonrec tag = {
  1. value : tag_value;
    (*

    The value of the tag.

    *)
  2. key : tag_key;
    (*

    The key for the tag.

    *)
}

A set of key-value pairs that are used to manage the resource. Tags can only be applied to permission sets and cannot be applied to corresponding roles that IAM Identity Center creates in Amazon Web Services accounts.

type nonrec tag_list = tag list
type nonrec tag_resource_request = {
  1. tags : tag_list;
    (*

    A set of key-value pairs that are used to manage the resource.

    *)
  2. resource_arn : taggable_resource_arn;
    (*

    The ARN of the resource with the tags to be listed.

    *)
  3. instance_arn : instance_arn option;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec service_quota_exceeded_message = string
type nonrec service_quota_exceeded_exception = {
  1. message : service_quota_exceeded_message option;
}

Indicates that the principal has crossed the permitted number of resources that can be created.

type nonrec status_values =
  1. | SUCCEEDED
  2. | FAILED
  3. | IN_PROGRESS
type nonrec scope = string
type nonrec scope_target = string
type nonrec scope_targets = scope_target list
type nonrec scope_details = {
  1. authorized_targets : scope_targets option;
    (*

    An array list of ARNs of applications.

    *)
  2. scope : scope;
    (*

    The name of the access scope.

    *)
}

A structure that describes an IAM Identity Center access scope and its authorized targets.

type nonrec scopes = scope_details list
type nonrec region_status =
  1. | REMOVING
  2. | ADDING
  3. | ACTIVE
type nonrec remove_region_response = {
  1. status : region_status option;
    (*

    The status of the Region after the remove operation. The status is REMOVING when the asynchronous workflow is in progress. The Region record is deleted when the workflow completes.

    *)
}
type nonrec region_name = string
type nonrec remove_region_request = {
  1. region_name : region_name;
    (*

    The name of the Amazon Web Services Region to remove from the IAM Identity Center instance. The Region name must be 1-32 characters long and follow the pattern of Amazon Web Services Region names (for example, us-east-1). The primary Region cannot be removed.

    *)
  2. instance_arn : instance_arn;
    (*

    The Amazon Resource Name (ARN) of the IAM Identity Center instance.

    *)
}
type nonrec put_permissions_boundary_to_permission_set_response = unit
type nonrec managed_policy_name = string
type nonrec managed_policy_path = string
type nonrec customer_managed_policy_reference = {
  1. path : managed_policy_path option;
    (*

    The path to the IAM policy that you have configured in each account where you want to deploy your permission set. The default is /. For more information, see Friendly names and paths in the IAM User Guide.

    *)
  2. name : managed_policy_name;
    (*

    The name of the IAM policy that you have configured in each account where you want to deploy your permission set.

    *)
}

Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each Amazon Web Services account where you want to deploy your permission set.

type nonrec managed_policy_arn = string
type nonrec permissions_boundary = {
  1. managed_policy_arn : managed_policy_arn option;
    (*

    The Amazon Web Services managed policy ARN that you want to attach to a permission set as a permissions boundary.

    *)
  2. customer_managed_policy_reference : customer_managed_policy_reference option;
    (*

    Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each Amazon Web Services account where you want to deploy your permission set.

    *)
}

Specifies the configuration of the Amazon Web Services managed or customer managed policy that you want to set as a permissions boundary. Specify either CustomerManagedPolicyReference to use the name and path of a customer managed policy, or ManagedPolicyArn to use the ARN of an Amazon Web Services managed policy. A permissions boundary represents the maximum permissions that any policy can grant your role. For more information, see Permissions boundaries for IAM entities in the IAM User Guide.

Policies used as permissions boundaries don't provide permissions. You must also attach an IAM policy to the role. To learn how the effective permissions for a role are evaluated, see IAM JSON policy evaluation logic in the IAM User Guide.

type nonrec put_permissions_boundary_to_permission_set_request = {
  1. permissions_boundary : permissions_boundary;
    (*

    The permissions boundary that you want to attach to a PermissionSet.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec put_inline_policy_to_permission_set_response = unit
type nonrec permission_set_policy_document = string
type nonrec put_inline_policy_to_permission_set_request = {
  1. inline_policy : permission_set_policy_document;
    (*

    The inline policy to attach to a PermissionSet.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec put_application_session_configuration_response = unit
type nonrec put_application_session_configuration_request = {
  1. user_background_session_application_status : user_background_session_application_status option;
    (*

    The status of user background sessions for the application.

    *)
  2. application_arn : application_arn;
    (*

    The Amazon Resource Name (ARN) of the application for which to update the session configuration.

    *)
}
type nonrec put_application_assignment_configuration_response = unit
type nonrec assignment_required = bool
type nonrec put_application_assignment_configuration_request = {
  1. assignment_required : assignment_required;
    (*

    If AssignmentsRequired is true (default value), users don’t have access to the application unless an assignment is created using the CreateApplicationAssignment API. If false, all users have access to the application.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec account_id = string
type nonrec reason = string
type nonrec date = Smaws_Lib.CoreTypes.Timestamp.t
type nonrec permission_set_provisioning_status = {
  1. created_date : date option;
    (*

    The date that the permission set was created.

    *)
  2. failure_reason : reason option;
    (*

    The message that contains an error or exception in case of an operation failure.

    *)
  3. permission_set_arn : permission_set_arn option;
    (*

    The ARN of the permission set that is being provisioned. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  4. account_id : account_id option;
    (*

    The identifier of the Amazon Web Services account from which to list the assignments.

    *)
  5. request_id : uu_id option;
    (*

    The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

    *)
  6. status : status_values option;
    (*

    The status of the permission set provisioning process.

    *)
}

A structure that is used to provide the status of the provisioning operation for a specified permission set.

type nonrec provision_permission_set_response = {
  1. permission_set_provisioning_status : permission_set_provisioning_status option;
    (*

    The status object for the permission set provisioning operation.

    *)
}
type nonrec provision_target_type =
  1. | ALL_PROVISIONED_ACCOUNTS
  2. | AWS_ACCOUNT
type nonrec provision_permission_set_request = {
  1. target_type : provision_target_type;
    (*

    The entity type for which the assignment will be created.

    *)
  2. target_id : target_id option;
    (*

    TargetID is an Amazon Web Services account identifier, (For example, 123456789012).

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec list_trusted_token_issuers_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. trusted_token_issuers : trusted_token_issuer_list option;
    (*

    An array list of the trusted token issuer configurations.

    *)
}
type nonrec max_results = int
type nonrec list_trusted_token_issuers_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  3. instance_arn : instance_arn;
    (*

    Specifies the ARN of the instance of IAM Identity Center with the trusted token issuer configurations that you want to list.

    *)
}
type nonrec list_tags_for_resource_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. tags : tag_list option;
    (*

    A set of key-value pairs that are used to manage the resource.

    *)
}
type nonrec list_tags_for_resource_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. resource_arn : taggable_resource_arn;
    (*

    The ARN of the resource with the tags to be listed.

    *)
  3. instance_arn : instance_arn option;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec is_primary_region = bool
type nonrec region_metadata = {
  1. is_primary_region : is_primary_region option;
    (*

    Indicates whether this is the primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.

    *)
  2. added_date : date option;
    (*

    The timestamp when the Region was added to the IAM Identity Center instance. For the primary Region, this is the instance creation time.

    *)
  3. status : region_status option;
    (*

    The current status of the Region. Valid values are ACTIVE (Region is operational), ADDING (Region extension workflow is in progress), or REMOVING (Region removal workflow is in progress).

    *)
  4. region_name : region_name option;
    (*

    The Amazon Web Services Region name.

    *)
}

Contains information about an enabled Region of an IAM Identity Center instance, including the Region name, status, date added, and whether it is the primary Region.

type nonrec region_metadata_list = region_metadata list
type nonrec list_regions_response = {
  1. next_token : token option;
    (*

    The pagination token to be used in subsequent calls. If the value is null, then there are no more entries.

    *)
  2. regions : region_metadata_list option;
    (*

    The list of Regions enabled in the IAM Identity Center instance, including Regions with ACTIVE, ADDING, or REMOVING status.

    *)
}
type nonrec list_regions_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to return in a single call. Default is 100.

    *)
  3. instance_arn : instance_arn;
    (*

    The Amazon Resource Name (ARN) of the IAM Identity Center instance.

    *)
}
type nonrec permission_set_list = permission_set_arn list
type nonrec list_permission_sets_provisioned_to_account_response = {
  1. permission_sets : permission_set_list option;
    (*

    Defines the level of access that an Amazon Web Services account has.

    *)
  2. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
}
type nonrec provisioning_status =
  1. | LATEST_PERMISSION_SET_NOT_PROVISIONED
  2. | LATEST_PERMISSION_SET_PROVISIONED
type nonrec list_permission_sets_provisioned_to_account_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  3. provisioning_status : provisioning_status option;
    (*

    The status object for the permission set provisioning operation.

    *)
  4. account_id : account_id;
    (*

    The identifier of the Amazon Web Services account from which to list the assignments.

    *)
  5. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec list_permission_sets_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. permission_sets : permission_set_list option;
    (*

    Defines the level of access on an Amazon Web Services account.

    *)
}
type nonrec list_permission_sets_request = {
  1. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  2. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec permission_set_provisioning_status_metadata = {
  1. created_date : date option;
    (*

    The date that the permission set was created.

    *)
  2. request_id : uu_id option;
    (*

    The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

    *)
  3. status : status_values option;
    (*

    The status of the permission set provisioning process.

    *)
}

Provides information about the permission set provisioning status.

type nonrec permission_set_provisioning_status_list = permission_set_provisioning_status_metadata list
type nonrec list_permission_set_provisioning_status_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. permission_sets_provisioning_status : permission_set_provisioning_status_list option;
    (*

    The status object for the permission set provisioning operation.

    *)
}
type nonrec operation_status_filter = {
  1. status : status_values option;
    (*

    Filters the list operations result based on the status attribute.

    *)
}

Filters the operation status list based on the passed attribute value.

type nonrec list_permission_set_provisioning_status_request = {
  1. filter : operation_status_filter option;
    (*

    Filters results based on the passed attribute value.

    *)
  2. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  3. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec name = string
type nonrec attached_managed_policy = {
  1. arn : managed_policy_arn option;
    (*

    The ARN of the Amazon Web Services managed policy. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  2. name : name option;
    (*

    The name of the Amazon Web Services managed policy.

    *)
}

A structure that stores a list of managed policy ARNs that describe the associated Amazon Web Services managed policy.

type nonrec attached_managed_policy_list = attached_managed_policy list
type nonrec list_managed_policies_in_permission_set_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. attached_managed_policies : attached_managed_policy_list option;
    (*

    An array of the AttachedManagedPolicy data type object.

    *)
}
type nonrec list_managed_policies_in_permission_set_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the PermissionSet.

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet whose managed policies will be listed.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec id = string
type nonrec instance_status =
  1. | ACTIVE
  2. | DELETE_IN_PROGRESS
  3. | CREATE_FAILED
  4. | CREATE_IN_PROGRESS
type nonrec instance_metadata = {
  1. regions : region_metadata_list option;
    (*

    The list of Regions enabled in the IAM Identity Center instance, including Regions with ACTIVE, ADDING, or REMOVING status.

    *)
  2. primary_region : region_name option;
    (*

    The primary Region where the IAM Identity Center instance was originally enabled. The primary Region cannot be removed.

    *)
  3. status_reason : reason option;
    (*

    Provides additional context about the current status of the IAM Identity Center instance. This field is particularly useful when an instance is in a non-ACTIVE state, such as CREATE_FAILED. When an instance creation fails, this field contains information about the cause, which may include issues with KMS key configuration or insufficient permissions.

    *)
  4. status : instance_status option;
    (*

    The current status of this Identity Center instance.

    *)
  5. created_date : date option;
    (*

    The date and time that the Identity Center instance was created.

    *)
  6. name : name_type option;
    (*

    The name of the Identity Center instance.

    *)
  7. owner_account_id : account_id option;
    (*

    The Amazon Web Services account ID number of the owner of the Identity Center instance.

    *)
  8. identity_store_id : id option;
    (*

    The identifier of the identity store that is connected to the Identity Center instance.

    *)
  9. instance_arn : instance_arn option;
    (*

    The ARN of the Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}

Provides information about the IAM Identity Center instance.

type nonrec instance_list = instance_metadata list
type nonrec list_instances_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. instances : instance_list option;
    (*

    Lists the IAM Identity Center instances that the caller has access to.

    *)
}
type nonrec list_instances_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the instance.

    *)
}
type nonrec customer_managed_policy_reference_list = customer_managed_policy_reference list
type nonrec list_customer_managed_policy_references_in_permission_set_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. customer_managed_policy_references : customer_managed_policy_reference_list option;
    (*

    Specifies the names and paths of the customer managed policies that you have attached to your permission set.

    *)
}
type nonrec list_customer_managed_policy_references_in_permission_set_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the list call.

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec application_provider_arn = string
type nonrec identity_store_arn = string
type nonrec application_visibility =
  1. | DISABLED
  2. | ENABLED
type nonrec portal_options = {
  1. visibility : application_visibility option;
    (*

    Indicates whether this application is visible in the access portal.

    *)
  2. sign_in_options : sign_in_options option;
    (*

    A structure that describes the sign-in options for the access portal.

    *)
}

A structure that describes the options for the access portal associated with an application.

type nonrec application = {
  1. created_from : region_name option;
    (*

    The Amazon Web Services Region where the application was created in IAM Identity Center.

    *)
  2. created_date : date option;
    (*

    The date and time when the application was originally created.

    *)
  3. description : description option;
    (*

    The description of the application.

    *)
  4. portal_options : portal_options option;
    (*

    A structure that describes the options for the access portal associated with this application.

    *)
  5. status : application_status option;
    (*

    The current status of the application in this instance of IAM Identity Center.

    *)
  6. identity_store_arn : identity_store_arn option;
    (*

    The ARN of the identity store that is connected to the instance of IAM Identity Center.

    *)
  7. instance_arn : instance_arn option;
    (*

    The ARN of the instance of IAM Identity Center that is configured with this application.

    *)
  8. application_account : account_id option;
    (*

    The Amazon Web Services account ID number of the application.

    *)
  9. name : application_name_type option;
    (*

    The name of the application.

    *)
  10. application_provider_arn : application_provider_arn option;
    (*

    The ARN of the application provider for this application.

    *)
  11. application_arn : application_arn option;
    (*

    The ARN of the application.

    *)
}

A structure that describes an application that uses IAM Identity Center for access management.

type nonrec application_list = application list
type nonrec list_applications_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. applications : application_list option;
    (*

    Retrieves all applications associated with the instance.

    *)
}
type nonrec list_applications_filter = {
  1. application_provider : application_provider_arn option;
    (*

    The ARN of an application provider that can filter the results in the response.

    *)
  2. application_account : account_id option;
    (*

    An Amazon Web Services account ID number that filters the results in the response.

    *)
}

A structure that describes a filter for applications.

type nonrec list_applications_request = {
  1. filter : list_applications_filter option;
    (*

    Filters response results.

    *)
  2. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  3. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center application under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec federation_protocol =
  1. | OAUTH
  2. | SAML
type nonrec icon_url = string
type nonrec display_data = {
  1. description : description option;
    (*

    The description of the application provider that appears in the portal.

    *)
  2. icon_url : icon_url option;
    (*

    A URL that points to an icon that represents the application provider.

    *)
  3. display_name : name option;
    (*

    The name of the application provider that appears in the portal.

    *)
}

A structure that describes how the portal represents an application provider.

type nonrec resource_server_scope_details = {
  1. detailed_title : description option;
    (*

    The title of an access scope for a resource server.

    *)
  2. long_description : description option;
    (*

    The description of an access scope for a resource server.

    *)
}

A structure that describes details for an IAM Identity Center access scope that is associated with a resource server.

type nonrec resource_server_scope = string
type nonrec resource_server_scopes = (resource_server_scope * resource_server_scope_details) list
type nonrec resource_server_config = {
  1. scopes : resource_server_scopes option;
    (*

    A list of the IAM Identity Center access scopes that are associated with this resource server.

    *)
}

A structure that describes the configuration of a resource server.

type nonrec application_provider = {
  1. resource_server_config : resource_server_config option;
    (*

    A structure that describes the application provider's resource server.

    *)
  2. display_data : display_data option;
    (*

    A structure that describes how IAM Identity Center represents the application provider in the portal.

    *)
  3. federation_protocol : federation_protocol option;
    (*

    The protocol that the application provider uses to perform federation.

    *)
  4. application_provider_arn : application_provider_arn;
    (*

    The ARN of the application provider.

    *)
}

A structure that describes a provider that can be used to connect an Amazon Web Services managed application or customer managed application to IAM Identity Center.

type nonrec application_provider_list = application_provider list
type nonrec list_application_providers_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. application_providers : application_provider_list option;
    (*

    An array list of structures that describe application providers.

    *)
}
type nonrec list_application_providers_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
}
type nonrec principal_id = string
type nonrec principal_type =
  1. | GROUP
  2. | USER
type nonrec application_assignment_for_principal = {
  1. principal_type : principal_type option;
    (*

    The type of the principal assigned to the application.

    *)
  2. principal_id : principal_id option;
    (*

    The unique identifier of the principal assigned to the application.

    *)
  3. application_arn : application_arn option;
    (*

    The ARN of the application to which the specified principal is assigned.

    *)
}

A structure that describes an application to which a principal is assigned.

type nonrec application_assignment_list_for_principal = application_assignment_for_principal list
type nonrec list_application_assignments_for_principal_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. application_assignments : application_assignment_list_for_principal option;
    (*

    An array list of the application assignments for the specified principal.

    *)
}
type nonrec list_application_assignments_filter = {
  1. application_arn : application_arn option;
    (*

    The ARN of an application.

    *)
}

A structure that describes a filter for application assignments.

type nonrec list_application_assignments_for_principal_request = {
  1. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  2. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  3. filter : list_application_assignments_filter option;
    (*

    Filters the output to include only assignments associated with the application that has the specified ARN.

    *)
  4. principal_type : principal_type;
    (*

    Specifies the type of the principal for which you want to retrieve its assignments.

    *)
  5. principal_id : principal_id;
    (*

    Specifies the unique identifier of the principal for which you want to retrieve its assignments.

    *)
  6. instance_arn : instance_arn;
    (*

    Specifies the instance of IAM Identity Center that contains principal and applications.

    *)
}
type nonrec application_assignment = {
  1. principal_type : principal_type;
    (*

    The type of the principal assigned to the application.

    *)
  2. principal_id : principal_id;
    (*

    The unique identifier of the principal assigned to the application.

    *)
  3. application_arn : application_arn;
    (*

    The ARN of the application that has principals assigned.

    *)
}

A structure that describes an assignment of a principal to an application.

type nonrec application_assignments_list = application_assignment list
type nonrec list_application_assignments_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. application_assignments : application_assignments_list option;
    (*

    The list of users assigned to an application.

    *)
}
type nonrec list_application_assignments_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec account_list = account_id list
type nonrec list_accounts_for_provisioned_permission_set_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. account_ids : account_list option;
    (*

    The list of Amazon Web Services AccountIds.

    *)
}
type nonrec list_accounts_for_provisioned_permission_set_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the PermissionSet.

    *)
  3. provisioning_status : provisioning_status option;
    (*

    The permission set provisioning status for an Amazon Web Services account.

    *)
  4. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet from which the associated Amazon Web Services accounts will be listed.

    *)
  5. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec account_assignment_for_principal = {
  1. principal_type : principal_type option;
    (*

    The type of the principal.

    *)
  2. principal_id : principal_id option;
    (*

    The ID of the principal.

    *)
  3. permission_set_arn : permission_set_arn option;
    (*

    The ARN of the IAM Identity Center permission set assigned to this principal for this Amazon Web Services account.

    *)
  4. account_id : account_id option;
    (*

    The account ID number of the Amazon Web Services account.

    *)
}

A structure that describes an assignment of an Amazon Web Services account to a principal and the permissions that principal has in the account.

type nonrec account_assignment_list_for_principal = account_assignment_for_principal list
type nonrec list_account_assignments_for_principal_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. account_assignments : account_assignment_list_for_principal option;
    (*

    An array list of the account assignments for the principal.

    *)
}
type nonrec list_account_assignments_filter = {
  1. account_id : account_id option;
    (*

    The ID number of an Amazon Web Services account that filters the results in the response.

    *)
}

A structure that describes a filter for account assignments.

type nonrec list_account_assignments_for_principal_request = {
  1. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  2. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  3. filter : list_account_assignments_filter option;
    (*

    Specifies an Amazon Web Services account ID number. Results are filtered to only those that match this ID number.

    *)
  4. principal_type : principal_type;
    (*

    Specifies the type of the principal.

    *)
  5. principal_id : principal_id;
    (*

    Specifies the principal for which you want to retrieve the list of account assignments.

    *)
  6. instance_arn : instance_arn;
    (*

    Specifies the ARN of the instance of IAM Identity Center that contains the principal.

    *)
}
type nonrec account_assignment = {
  1. principal_id : principal_id option;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  2. principal_type : principal_type option;
    (*

    The entity type for which the assignment will be created.

    *)
  3. permission_set_arn : permission_set_arn option;
    (*

    The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  4. account_id : account_id option;
    (*

    The identifier of the Amazon Web Services account.

    *)
}

The assignment that indicates a principal's limited access to a specified Amazon Web Services account with a specified permission set.

The term principal here refers to a user or group that is defined in IAM Identity Center.

type nonrec account_assignment_list = account_assignment list
type nonrec list_account_assignments_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. account_assignments : account_assignment_list option;
    (*

    The list of assignments that match the input Amazon Web Services account and permission set.

    *)
}
type nonrec list_account_assignments_request = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set from which to list assignments.

    *)
  4. account_id : target_id;
    (*

    The identifier of the Amazon Web Services account from which to list the assignments.

    *)
  5. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec account_assignment_operation_status_metadata = {
  1. created_date : date option;
    (*

    The date that the permission set was created.

    *)
  2. request_id : uu_id option;
    (*

    The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

    *)
  3. status : status_values option;
    (*

    The status of the permission set provisioning process.

    *)
}

Provides information about the AccountAssignment creation request.

type nonrec account_assignment_operation_status_list = account_assignment_operation_status_metadata list
type nonrec list_account_assignment_deletion_status_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. account_assignments_deletion_status : account_assignment_operation_status_list option;
    (*

    The status object for the account assignment deletion operation.

    *)
}
type nonrec list_account_assignment_deletion_status_request = {
  1. filter : operation_status_filter option;
    (*

    Filters results based on the passed attribute value.

    *)
  2. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  3. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec list_account_assignment_creation_status_response = {
  1. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  2. account_assignments_creation_status : account_assignment_operation_status_list option;
    (*

    The status object for the account assignment creation operation.

    *)
}
type nonrec list_account_assignment_creation_status_request = {
  1. filter : operation_status_filter option;
    (*

    Filters results based on the passed attribute value.

    *)
  2. next_token : token option;
    (*

    The pagination token for the list API. Initially the value is null. Use the output of previous API calls to make subsequent calls.

    *)
  3. max_results : max_results option;
    (*

    The maximum number of results to display for the assignment.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec get_permissions_boundary_for_permission_set_response = {
  1. permissions_boundary : permissions_boundary option;
    (*

    The permissions boundary attached to the specified permission set.

    *)
}
type nonrec get_permissions_boundary_for_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec get_inline_policy_for_permission_set_response = {
  1. inline_policy : permission_set_policy_document option;
    (*

    The inline policy that is attached to the permission set.

    For Length Constraints, if a valid ARN is provided for a permission set, it is possible for an empty inline policy to be returned.

    *)
}
type nonrec get_inline_policy_for_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec get_application_session_configuration_response = {
  1. user_background_session_application_status : user_background_session_application_status option;
    (*

    The status of user background sessions for the application.

    *)
}
type nonrec get_application_session_configuration_request = {
  1. application_arn : application_arn;
    (*

    The Amazon Resource Name (ARN) of the application for which to retrieve the session configuration.

    *)
}
type nonrec get_application_assignment_configuration_response = {
  1. assignment_required : assignment_required;
    (*

    If AssignmentsRequired is true (default value), users don’t have access to the application unless an assignment is created using the CreateApplicationAssignment API. If false, all users have access to the application.

    *)
}
type nonrec get_application_assignment_configuration_request = {
  1. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec detach_managed_policy_from_permission_set_response = unit
type nonrec detach_managed_policy_from_permission_set_request = {
  1. managed_policy_arn : managed_policy_arn;
    (*

    The Amazon Web Services managed policy ARN to be detached from a permission set.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet from which the policy should be detached.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec detach_customer_managed_policy_reference_from_permission_set_response = unit
type nonrec detach_customer_managed_policy_reference_from_permission_set_request = {
  1. customer_managed_policy_reference : customer_managed_policy_reference;
    (*

    Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each Amazon Web Services account where you want to deploy your permission set.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec describe_trusted_token_issuer_response = {
  1. trusted_token_issuer_configuration : trusted_token_issuer_configuration option;
    (*

    A structure the describes the settings that apply of this trusted token issuer.

    *)
  2. trusted_token_issuer_type : trusted_token_issuer_type option;
    (*

    The type of the trusted token issuer.

    *)
  3. name : trusted_token_issuer_name option;
    (*

    The name of the trusted token issuer configuration.

    *)
  4. trusted_token_issuer_arn : trusted_token_issuer_arn option;
    (*

    The ARN of the trusted token issuer configuration.

    *)
}
type nonrec describe_trusted_token_issuer_request = {
  1. trusted_token_issuer_arn : trusted_token_issuer_arn;
    (*

    Specifies the ARN of the trusted token issuer configuration that you want details about.

    *)
}
type nonrec describe_region_response = {
  1. is_primary_region : is_primary_region option;
    (*

    Indicates whether this is the primary Region where the IAM Identity Center instance was originally enabled. For more information on the difference between the primary Region and additional Regions, see IAM Identity Center User Guide

    *)
  2. added_date : date option;
    (*

    The timestamp when the Region was added to the IAM Identity Center instance. For the primary Region, this is the IAM Identity Center instance creation time.

    *)
  3. status : region_status option;
    (*

    The current status of the Region. Valid values are ACTIVE (Region is operational), ADDING (Region replication workflow is in progress), or REMOVING (Region removal workflow is in progress).

    *)
  4. region_name : region_name option;
    (*

    The Amazon Web Services Region name.

    *)
}
type nonrec describe_region_request = {
  1. region_name : region_name;
    (*

    The name of the Amazon Web Services Region to retrieve information about. The Region name must be 1-32 characters long and follow the pattern of Amazon Web Services Region names (for example, us-east-1).

    *)
  2. instance_arn : instance_arn;
    (*

    The Amazon Resource Name (ARN) of the IAM Identity Center instance.

    *)
}
type nonrec describe_permission_set_provisioning_status_response = {
  1. permission_set_provisioning_status : permission_set_provisioning_status option;
    (*

    The status object for the permission set provisioning operation.

    *)
}
type nonrec describe_permission_set_provisioning_status_request = {
  1. provision_permission_set_request_id : uu_id;
    (*

    The identifier that is provided by the ProvisionPermissionSet call to retrieve the current status of the provisioning workflow.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec permission_set_name = string
type nonrec permission_set = {
  1. relay_state : relay_state option;
    (*

    Used to redirect users within the application during the federation authentication process.

    *)
  2. session_duration : duration option;
    (*

    The length of time that the application user sessions are valid for in the ISO-8601 standard.

    *)
  3. created_date : date option;
    (*

    The date that the permission set was created.

    *)
  4. description : permission_set_description option;
    (*

    The description of the PermissionSet.

    *)
  5. permission_set_arn : permission_set_arn option;
    (*

    The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  6. name : permission_set_name option;
    (*

    The name of the permission set.

    *)
}

An entity that contains IAM policies.

type nonrec describe_permission_set_response = {
  1. permission_set : permission_set option;
    (*

    Describes the level of access on an Amazon Web Services account.

    *)
}
type nonrec describe_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec instance_access_control_attribute_configuration_status =
  1. | CREATION_FAILED
  2. | CREATION_IN_PROGRESS
  3. | ENABLED
type nonrec instance_access_control_attribute_configuration_status_reason = string
type nonrec describe_instance_access_control_attribute_configuration_response = {
  1. instance_access_control_attribute_configuration : instance_access_control_attribute_configuration option;
    (*

    Gets the list of IAM Identity Center identity store attributes that have been added to your ABAC configuration.

    *)
  2. status_reason : instance_access_control_attribute_configuration_status_reason option;
    (*

    Provides more details about the current status of the specified attribute.

    *)
  3. status : instance_access_control_attribute_configuration_status option;
    (*

    The status of the attribute configuration process.

    *)
}
type nonrec describe_instance_access_control_attribute_configuration_request = {
  1. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec kms_key_status =
  1. | UPDATE_FAILED
  2. | ENABLED
  3. | UPDATING
type nonrec encryption_configuration_details = {
  1. encryption_status_reason : reason option;
    (*

    Provides additional context about the current encryption status. This field is particularly useful when the encryption status is UPDATE_FAILED. When encryption configuration update fails, this field contains information about the cause, which may include KMS key access issues, key not found errors, invalid key configuration, key in an invalid state, or a disabled key.

    *)
  2. encryption_status : kms_key_status option;
    (*

    The current status of encryption configuration.

    *)
  3. kms_key_arn : kms_key_arn option;
    (*

    The ARN of the KMS key currently used to encrypt data in your IAM Identity Center instance.

    *)
  4. key_type : kms_key_type option;
    (*

    The type of KMS key used for encryption.

    *)
}

The encryption configuration of your IAM Identity Center instance, including the key type, KMS key ARN, and current encryption status.

type nonrec describe_instance_response = {
  1. encryption_configuration_details : encryption_configuration_details option;
    (*

    Contains the encryption configuration for your IAM Identity Center instance, including the encryption status, KMS key type, and KMS key ARN.

    *)
  2. status_reason : reason option;
    (*

    Provides additional context about the current status of the IAM Identity Center instance. This field is particularly useful when an instance is in a non-ACTIVE state, such as CREATE_FAILED. When an instance fails to create or update, this field contains information about the cause, which may include issues with KMS key configuration, permission problems with the specified KMS key, or service-related errors.

    *)
  3. status : instance_status option;
    (*

    The status of the instance.

    *)
  4. created_date : date option;
    (*

    The date the instance was created.

    *)
  5. name : name_type option;
    (*

    Specifies the instance name.

    *)
  6. owner_account_id : account_id option;
    (*

    The identifier of the Amazon Web Services account for which the instance was created.

    *)
  7. identity_store_id : id option;
    (*

    The identifier of the identity store that is connected to the instance of IAM Identity Center.

    *)
  8. instance_arn : instance_arn option;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec describe_instance_request = {
  1. instance_arn : instance_arn;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run.

    *)
}
type nonrec describe_application_provider_response = {
  1. resource_server_config : resource_server_config option;
    (*

    A structure with details about the receiving application.

    *)
  2. display_data : display_data option;
    (*

    A structure with details about the display data for the application provider.

    *)
  3. federation_protocol : federation_protocol option;
    (*

    The protocol used to federate to the application provider.

    *)
  4. application_provider_arn : application_provider_arn;
    (*

    The ARN of the application provider.

    *)
}
type nonrec describe_application_provider_request = {
  1. application_provider_arn : application_provider_arn;
    (*

    Specifies the ARN of the application provider for which you want details.

    *)
}
type nonrec describe_application_assignment_response = {
  1. application_arn : application_arn option;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  2. principal_id : principal_id option;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  3. principal_type : principal_type option;
    (*

    The entity type for which the assignment will be created.

    *)
}
type nonrec describe_application_assignment_request = {
  1. principal_type : principal_type;
    (*

    The entity type for which the assignment will be created.

    *)
  2. principal_id : principal_id;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec describe_application_response = {
  1. created_from : region_name option;
    (*

    The Amazon Web Services Region where the application was created in IAM Identity Center.

    *)
  2. created_date : date option;
    (*

    The date the application was created.

    *)
  3. description : description option;
    (*

    The description of the .

    *)
  4. portal_options : portal_options option;
    (*

    A structure that describes the options for the portal associated with an application.

    *)
  5. status : application_status option;
    (*

    Specifies whether the application is enabled or disabled.

    *)
  6. identity_store_arn : identity_store_arn option;
    (*

    The ARN of the identity store that is connected to the instance of IAM Identity Center.

    *)
  7. instance_arn : instance_arn option;
    (*

    The ARN of the IAM Identity Center application under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  8. application_account : account_id option;
    (*

    The account ID.

    *)
  9. name : application_name_type option;
    (*

    The application name.

    *)
  10. application_provider_arn : application_provider_arn option;
    (*

    The ARN of the application provider under which the operation will run.

    *)
  11. application_arn : application_arn option;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec describe_application_request = {
  1. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec account_assignment_operation_status = {
  1. created_date : date option;
    (*

    The date that the permission set was created.

    *)
  2. principal_id : principal_id option;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  3. principal_type : principal_type option;
    (*

    The entity type for which the assignment will be created.

    *)
  4. permission_set_arn : permission_set_arn option;
    (*

    The ARN of the permission set. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  5. target_type : target_type option;
    (*

    The entity type for which the assignment will be created.

    *)
  6. target_id : target_id option;
    (*

    TargetID is an Amazon Web Services account identifier, (For example, 123456789012).

    *)
  7. failure_reason : reason option;
    (*

    The message that contains an error or exception in case of an operation failure.

    *)
  8. request_id : uu_id option;
    (*

    The identifier for tracking the request operation that is generated by the universally unique identifier (UUID) workflow.

    *)
  9. status : status_values option;
    (*

    The status of the permission set provisioning process.

    *)
}

The status of the creation or deletion operation of an assignment that a principal needs to access an account.

type nonrec describe_account_assignment_deletion_status_response = {
  1. account_assignment_deletion_status : account_assignment_operation_status option;
    (*

    The status object for the account assignment deletion operation.

    *)
}
type nonrec describe_account_assignment_deletion_status_request = {
  1. account_assignment_deletion_request_id : uu_id;
    (*

    The identifier that is used to track the request operation progress.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec describe_account_assignment_creation_status_response = {
  1. account_assignment_creation_status : account_assignment_operation_status option;
    (*

    The status object for the account assignment creation operation.

    *)
}
type nonrec describe_account_assignment_creation_status_request = {
  1. account_assignment_creation_request_id : uu_id;
    (*

    The identifier that is used to track the request operation progress.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec delete_trusted_token_issuer_response = unit
type nonrec delete_trusted_token_issuer_request = {
  1. trusted_token_issuer_arn : trusted_token_issuer_arn;
    (*

    Specifies the ARN of the trusted token issuer configuration to delete.

    *)
}
type nonrec delete_permission_set_response = unit
type nonrec delete_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set that should be deleted.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec delete_permissions_boundary_from_permission_set_response = unit
type nonrec delete_permissions_boundary_from_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec delete_instance_access_control_attribute_configuration_response = unit
type nonrec delete_instance_access_control_attribute_configuration_request = {
  1. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec delete_instance_response = unit
type nonrec delete_instance_request = {
  1. instance_arn : instance_arn;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run.

    *)
}
type nonrec delete_inline_policy_from_permission_set_response = unit
type nonrec delete_inline_policy_from_permission_set_request = {
  1. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set that will be used to remove access.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec delete_application_assignment_response = unit
type nonrec delete_application_assignment_request = {
  1. principal_type : principal_type;
    (*

    The entity type for which the assignment will be deleted.

    *)
  2. principal_id : principal_id;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec delete_application_response = unit
type nonrec delete_application_request = {
  1. application_arn : application_arn;
    (*

    Specifies the ARN of the application. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec delete_account_assignment_response = {
  1. account_assignment_deletion_status : account_assignment_operation_status option;
    (*

    The status object for the account assignment deletion operation.

    *)
}
type nonrec delete_account_assignment_request = {
  1. principal_id : principal_id;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  2. principal_type : principal_type;
    (*

    The entity type for which the assignment will be deleted.

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set that will be used to remove access.

    *)
  4. target_type : target_type;
    (*

    The entity type for which the assignment will be deleted.

    *)
  5. target_id : target_id;
    (*

    TargetID is an Amazon Web Services account identifier, (For example, 123456789012).

    *)
  6. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec create_trusted_token_issuer_response = {
  1. trusted_token_issuer_arn : trusted_token_issuer_arn option;
    (*

    The ARN of the new trusted token issuer configuration.

    *)
}
type nonrec client_token = string
type nonrec create_trusted_token_issuer_request = {
  1. tags : tag_list option;
    (*

    Specifies tags to be attached to the new trusted token issuer configuration.

    *)
  2. client_token : client_token option;
    (*

    Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value..

    If you don't provide this value, then Amazon Web Services generates a random one for you.

    If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

    *)
  3. trusted_token_issuer_configuration : trusted_token_issuer_configuration;
    (*

    Specifies settings that apply to the new trusted token issuer configuration. The settings that are available depend on what TrustedTokenIssuerType you specify.

    *)
  4. trusted_token_issuer_type : trusted_token_issuer_type;
    (*

    Specifies the type of the new trusted token issuer.

    *)
  5. name : trusted_token_issuer_name;
    (*

    Specifies the name of the new trusted token issuer configuration.

    *)
  6. instance_arn : instance_arn;
    (*

    Specifies the ARN of the instance of IAM Identity Center to contain the new trusted token issuer configuration.

    *)
}
type nonrec create_permission_set_response = {
  1. permission_set : permission_set option;
    (*

    Defines the level of access on an Amazon Web Services account.

    *)
}
type nonrec create_permission_set_request = {
  1. tags : tag_list option;
    (*

    The tags to attach to the new PermissionSet.

    *)
  2. relay_state : relay_state option;
    (*

    Used to redirect users within the application during the federation authentication process.

    *)
  3. session_duration : duration option;
    (*

    The length of time that the application user sessions are valid in the ISO-8601 standard.

    *)
  4. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  5. description : permission_set_description option;
    (*

    The description of the PermissionSet.

    *)
  6. name : permission_set_name;
    (*

    The name of the PermissionSet.

    *)
}
type nonrec create_instance_access_control_attribute_configuration_response = unit
type nonrec create_instance_access_control_attribute_configuration_request = {
  1. instance_access_control_attribute_configuration : instance_access_control_attribute_configuration;
    (*

    Specifies the IAM Identity Center identity store attributes to add to your ABAC configuration. When using an external identity provider as an identity source, you can pass attributes through the SAML assertion. Doing so provides an alternative to configuring attributes from the IAM Identity Center identity store. If a SAML assertion passes any of these attributes, IAM Identity Center will replace the attribute value with the value from the IAM Identity Center identity store.

    *)
  2. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec create_instance_response = {
  1. instance_arn : instance_arn option;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run.

    For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec create_instance_request = {
  1. tags : tag_list option;
    (*

    Specifies tags to be attached to the instance of IAM Identity Center.

    *)
  2. client_token : client_token option;
    (*

    Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value.

    If you don't provide this value, then Amazon Web Services generates a random one for you.

    If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

    *)
  3. name : name_type option;
    (*

    The name of the instance of IAM Identity Center.

    *)
}
type nonrec create_application_assignment_response = unit
type nonrec create_application_assignment_request = {
  1. principal_type : principal_type;
    (*

    The entity type for which the assignment will be created.

    *)
  2. principal_id : principal_id;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  3. application_arn : application_arn;
    (*

    The ARN of the application for which the assignment is created.

    *)
}
type nonrec create_application_response = {
  1. identity_store_arn : identity_store_arn option;
    (*

    The ARN of the identity store that is connected to the instance of IAM Identity Center.

    *)
  2. instance_arn : instance_arn option;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
  3. application_arn : application_arn option;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec create_application_request = {
  1. client_token : client_token option;
    (*

    Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value.

    If you don't provide this value, then Amazon Web Services generates a random one for you.

    If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an IdempotentParameterMismatch error.

    *)
  2. status : application_status option;
    (*

    Specifies whether the application is enabled or disabled.

    *)
  3. tags : tag_list option;
    (*

    Specifies tags to be attached to the application.

    *)
  4. portal_options : portal_options option;
    (*

    A structure that describes the options for the portal associated with an application.

    *)
  5. description : description option;
    (*

    The description of the .

    *)
  6. name : application_name_type;
    (*

    The name of the .

    *)
  7. application_provider_arn : application_provider_arn;
    (*

    The ARN of the application provider under which the operation will run.

    *)
  8. instance_arn : instance_arn;
    (*

    The ARN of the instance of IAM Identity Center under which the operation will run. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec create_account_assignment_response = {
  1. account_assignment_creation_status : account_assignment_operation_status option;
    (*

    The status object for the account assignment creation operation.

    *)
}
type nonrec create_account_assignment_request = {
  1. principal_id : principal_id;
    (*

    An identifier for an object in IAM Identity Center, such as a user or group. PrincipalIds are GUIDs (For example, f81d4fae-7dec-11d0-a765-00a0c91e6bf6). For more information about PrincipalIds in IAM Identity Center, see the IAM Identity Center Identity Store API Reference.

    *)
  2. principal_type : principal_type;
    (*

    The entity type for which the assignment will be created.

    *)
  3. permission_set_arn : permission_set_arn;
    (*

    The ARN of the permission set that the admin wants to grant the principal access to.

    *)
  4. target_type : target_type;
    (*

    The entity type for which the assignment will be created.

    *)
  5. target_id : target_id;
    (*

    TargetID is an Amazon Web Services account identifier, (For example, 123456789012).

    *)
  6. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec attach_managed_policy_to_permission_set_response = unit
type nonrec attach_managed_policy_to_permission_set_request = {
  1. managed_policy_arn : managed_policy_arn;
    (*

    The Amazon Web Services managed policy ARN to be attached to a permission set.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet that the managed policy should be attached to.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed. For more information about ARNs, see Amazon Resource Names (ARNs) and Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.

    *)
}
type nonrec attach_customer_managed_policy_reference_to_permission_set_response = unit
type nonrec attach_customer_managed_policy_reference_to_permission_set_request = {
  1. customer_managed_policy_reference : customer_managed_policy_reference;
    (*

    Specifies the name and path of a customer managed policy. You must have an IAM policy that matches the name and path in each Amazon Web Services account where you want to deploy your permission set.

    *)
  2. permission_set_arn : permission_set_arn;
    (*

    The ARN of the PermissionSet.

    *)
  3. instance_arn : instance_arn;
    (*

    The ARN of the IAM Identity Center instance under which the operation will be executed.

    *)
}
type nonrec add_region_response = {
  1. status : region_status option;
    (*

    The status of the Region after the Add operation. The status is ADDING when the asynchronous workflow is in progress and changes to ACTIVE when complete.

    *)
}
type nonrec add_region_request = {
  1. region_name : region_name;
    (*

    The name of the Amazon Web Services Region to add to the IAM Identity Center instance. The Region name must be 1-32 characters long and follow the pattern of Amazon Web Services Region names (for example, us-east-1).

    *)
  2. instance_arn : instance_arn;
    (*

    The Amazon Resource Name (ARN) of the IAM Identity Center instance to replicate to the target Region.

    *)
}
type nonrec refresh_token_grant = unit
type nonrec redirect_uris = ur_i list
type nonrec grant_type =
  1. | TOKEN_EXCHANGE
  2. | JWT_BEARER
  3. | REFRESH_TOKEN
  4. | AUTHORIZATION_CODE
type nonrec authorization_code_grant = {
  1. redirect_uris : redirect_uris option;
    (*

    A list of URIs that are valid locations to redirect a user's browser after the user is authorized.

    RedirectUris is required when the grant type is authorization_code.

    *)
}

A structure that defines configuration settings for an application that supports the OAuth 2.0 Authorization Code Grant.

type nonrec authorized_token_issuer = {
  1. authorized_audiences : token_issuer_audiences option;
    (*

    An array list of authorized audiences, or applications, that can consume the tokens generated by the associated trusted token issuer.

    *)
  2. trusted_token_issuer_arn : trusted_token_issuer_arn option;
    (*

    The ARN of the trusted token issuer.

    *)
}

A structure that describes a trusted token issuer and associates it with a set of authorized audiences.

type nonrec authorized_token_issuers = authorized_token_issuer list
type nonrec jwt_bearer_grant = {
  1. authorized_token_issuers : authorized_token_issuers option;
    (*

    A list of allowed token issuers trusted by the Identity Center instances for this application.

    AuthorizedTokenIssuers is required when the grant type is JwtBearerGrant.

    *)
}

A structure that defines configuration settings for an application that supports the JWT Bearer Token Authorization Grant. The AuthorizedAudience field is the aud claim. For more information, see RFC 7523.

type nonrec grant =
  1. | TokenExchange of token_exchange_grant
    (*

    Configuration options for the urn:ietf:params:oauth:grant-type:token-exchange grant type.

    *)
  2. | RefreshToken of refresh_token_grant
    (*

    Configuration options for the refresh_token grant type.

    *)
  3. | JwtBearer of jwt_bearer_grant
    (*

    Configuration options for the urn:ietf:params:oauth:grant-type:jwt-bearer grant type.

    *)
  4. | AuthorizationCode of authorization_code_grant
    (*

    Configuration options for the authorization_code grant type.

    *)

The Grant union represents the set of possible configuration options for the selected grant type. Exactly one member of the union must be specified, and must match the grant type selected.

type nonrec put_application_grant_request = {
  1. grant : grant;
    (*

    Specifies a structure that describes the grant to update.

    *)
  2. grant_type : grant_type;
    (*

    Specifies the type of grant to update.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application to update.

    *)
}
type nonrec authentication_method_type =
  1. | IAM
type nonrec actor_policy_document = Smaws_Lib.CoreTypes.Document.t
type nonrec iam_authentication_method = {
  1. actor_policy : actor_policy_document;
    (*

    An IAM policy document in JSON.

    *)
}

A structure that describes details for authentication that uses IAM.

type nonrec authentication_method =
  1. | Iam of iam_authentication_method
    (*

    A structure that describes details for IAM authentication.

    *)

A structure that describes an authentication method that can be used by an application.

type nonrec put_application_authentication_method_request = {
  1. authentication_method : authentication_method;
    (*

    Specifies a structure that describes the authentication method to add or update. The structure type you provide is determined by the AuthenticationMethodType parameter.

    *)
  2. authentication_method_type : authentication_method_type;
    (*

    Specifies the type of the authentication method that you want to add or update.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the authentication method to add or update.

    *)
}
type nonrec put_application_access_scope_request = {
  1. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the access scope with the targets to add or update.

    *)
  2. authorized_targets : scope_targets option;
    (*

    Specifies an array list of ARNs that represent the authorized targets for this access scope.

    *)
  3. scope : scope;
    (*

    Specifies the name of the access scope to be associated with the specified targets.

    *)
}
type nonrec grant_item = {
  1. grant : grant;
    (*

    The configuration structure for the selected grant.

    *)
  2. grant_type : grant_type;
    (*

    The type of the selected grant.

    *)
}

A structure that defines a single grant and its configuration.

type nonrec grants = grant_item list
type nonrec list_application_grants_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. grants : grants;
    (*

    An array list of structures that describe the requested grants.

    *)
}
type nonrec list_application_grants_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application whose grants you want to list.

    *)
}
type nonrec authentication_method_item = {
  1. authentication_method : authentication_method option;
    (*

    A structure that describes an authentication method. The contents of this structure is determined by the AuthenticationMethodType.

    *)
  2. authentication_method_type : authentication_method_type option;
    (*

    The type of authentication that is used by this method.

    *)
}

A structure that describes an authentication method and its type.

type nonrec authentication_methods = authentication_method_item list
type nonrec list_application_authentication_methods_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. authentication_methods : authentication_methods option;
    (*

    An array list of authentication methods for the specified application.

    *)
}
type nonrec list_application_authentication_methods_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the authentication methods you want to list.

    *)
}
type nonrec list_application_access_scopes_response = {
  1. next_token : token option;
    (*

    If present, this value indicates that more output is available than is included in the current response. Use this value in the NextToken request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the NextToken response element comes back as null. This indicates that this is the last page of results.

    *)
  2. scopes : scopes;
    (*

    An array list of access scopes and their authorized targets that are associated with the application.

    *)
}
type nonrec list_application_access_scopes_request = {
  1. next_token : token option;
    (*

    Specifies that you want to receive the next page of results. Valid only if you received a NextToken response in the previous request. If you did, it indicates that more output is available. Set this parameter to the value provided by the previous call's NextToken response to request the next page of results.

    *)
  2. max_results : max_results option;
    (*

    Specifies the total number of results that you want included in each response. If additional items exist beyond the number you specify, the NextToken response element is returned with a value (not null). Include the specified value as the NextToken request parameter in the next call to the operation to get the next set of results. Note that the service might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

    *)
  3. application_arn : application_arn;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec get_application_grant_response = {
  1. grant : grant;
    (*

    A structure that describes the requested grant.

    *)
}
type nonrec get_application_grant_request = {
  1. grant_type : grant_type;
    (*

    Specifies the type of grant.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application that contains the grant.

    *)
}
type nonrec get_application_authentication_method_response = {
  1. authentication_method : authentication_method option;
    (*

    A structure that contains details about the requested authentication method.

    *)
}
type nonrec get_application_authentication_method_request = {
  1. authentication_method_type : authentication_method_type;
    (*

    Specifies the type of authentication method for which you want details.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application.

    *)
}
type nonrec get_application_access_scope_response = {
  1. authorized_targets : scope_targets option;
    (*

    An array of authorized targets associated with this access scope.

    *)
  2. scope : scope;
    (*

    The name of the access scope that can be used with the authorized targets.

    *)
}
type nonrec get_application_access_scope_request = {
  1. scope : scope;
    (*

    Specifies the name of the access scope for which you want the authorized targets.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the access scope that you want to retrieve.

    *)
}
type nonrec delete_application_grant_request = {
  1. grant_type : grant_type;
    (*

    Specifies the type of grant to delete from the application.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the grant to delete.

    *)
}
type nonrec delete_application_authentication_method_request = {
  1. authentication_method_type : authentication_method_type;
    (*

    Specifies the authentication method type to delete from the application.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the authentication method to delete.

    *)
}
type nonrec delete_application_access_scope_request = {
  1. scope : scope;
    (*

    Specifies the name of the access scope to remove from the application.

    *)
  2. application_arn : application_arn;
    (*

    Specifies the ARN of the application with the access scope to delete.

    *)
}
type nonrec application_grant_resource = Smaws_Lib.CoreTypes.Resource.t
type nonrec application_authentication_method_resource = Smaws_Lib.CoreTypes.Resource.t
type nonrec application_access_scope_resource = Smaws_Lib.CoreTypes.Resource.t