AWS SupportAuthZ enables you to control and authorize the actions that AWS support operators can perform on your resources. You create cryptographically signed support permits specifying which actions operators can perform, on which resources, and under what time-window conditions. Permits are signed using a customer-managed AWS KMS key (ECC_NIST_P384, SIGN_VERIFY) to ensure non-repudiation.
", "operations": { "CreateSupportPermit": "Creates a support permit that authorizes an AWS support operator to perform specified actions on specified resources. The permit is cryptographically signed using a customer-managed AWS KMS key (ECC_NIST_P384, SIGN_VERIFY) to ensure non-repudiation.
", "DeleteSupportPermit": "Deletes a support permit, revoking the authorization previously granted to the AWS support operator.
", "GetAction": "Retrieves the description of a specific support action.
", "GetSupportPermit": "Retrieves the details of a support permit by its ARN or name.
", "ListActions": "Lists available support actions for a specified AWS service. Use pagination to ensure that the operation returns quickly and successfully.
", "ListSupportPermitRequests": "Lists permit requests from AWS support operators. Use pagination to ensure that the operation returns quickly and successfully.
", "ListSupportPermits": "Lists all support permits in the caller's account. Use pagination to ensure that the operation returns quickly and successfully.
", "ListTagsForResource": "Lists the tags associated with a support permit resource.
", "RejectSupportPermitRequest": "Rejects a permit request from an AWS support operator. The operator cannot proceed with the requested action.
", "TagResource": "Adds or overwrites one or more tags for a support permit resource.
", "UntagResource": "Removes one or more tags from a support permit resource.
" }, "shapes": { "AccessDeniedException": { "base": "You don't have sufficient permissions to perform this operation.
", "refs": {} }, "Action": { "base": null, "refs": { "ActionSummary$action": "The name of the support action.
", "Actions$member": null, "GetActionInput$action": "The name of the support action to retrieve.
", "GetActionOutput$action": "The name of the support action.
" } }, "ActionDescription": { "base": null, "refs": { "ActionSummary$description": "A description of what the support action does.
", "GetActionOutput$description": "A description of what the support action does.
" } }, "ActionSet": { "base": "The set of actions authorized by a permit. Specify either all actions or a list of specific actions.
", "refs": { "Permit$actions": "The set of actions that the support operator is authorized to perform.
" } }, "ActionSummaries": { "base": null, "refs": { "ListActionsOutput$actionSummaries": "The list of support actions.
" } }, "ActionSummary": { "base": "A summary of a support action.
", "refs": { "ActionSummaries$member": null } }, "Actions": { "base": null, "refs": { "ActionSet$actions": "A list of specific support actions to authorize. Maximum of 10 actions.
" } }, "Arn": { "base": null, "refs": { "CreateSupportPermitOutput$arn": "The Amazon Resource Name (ARN) of the support permit.
", "DeleteSupportPermitInput$supportPermitIdentifier": "The Amazon Resource Name (ARN) or name of the support permit to delete.
", "DeleteSupportPermitOutput$arn": "The ARN of the deleted support permit.
", "GetSupportPermitOutput$arn": "The ARN of the support permit.
", "ListTagsForResourceInput$resourceArn": "The ARN of the resource to list tags for.
", "SupportPermitSummary$arn": "The ARN of the support permit.
", "TagResourceInput$resourceArn": "The ARN of the resource to tag.
", "UntagResourceInput$resourceArn": "The ARN of the resource to untag.
" } }, "ClientToken": { "base": null, "refs": { "CreateSupportPermitInput$clientToken": "A unique, case-sensitive identifier to ensure that the operation completes no more than one time. If this token matches a previous request, the service returns the existing permit without creating a duplicate.
" } }, "Condition": { "base": "A time-window condition that constrains when a support permit is valid.
", "refs": { "Conditions$member": null } }, "Conditions": { "base": null, "refs": { "Permit$conditions": "The time-window conditions that constrain when the permit is valid. Maximum of 2 conditions.
" } }, "ConflictException": { "base": "The request conflicts with the current state of the resource.
", "refs": {} }, "CreateSupportPermitInput": { "base": null, "refs": {} }, "CreateSupportPermitOutput": { "base": null, "refs": {} }, "DeleteSupportPermitInput": { "base": null, "refs": {} }, "DeleteSupportPermitOutput": { "base": null, "refs": {} }, "Description": { "base": null, "refs": { "CreateSupportPermitInput$description": "A human-readable description of why this permit is being created. Maximum length of 1024 characters.
", "CreateSupportPermitOutput$description": "The description of the support permit.
", "DeleteSupportPermitOutput$description": "The description of the deleted support permit.
", "GetSupportPermitOutput$description": "The description of the support permit.
" } }, "GetActionInput": { "base": null, "refs": {} }, "GetActionOutput": { "base": null, "refs": {} }, "GetSupportPermitInput": { "base": null, "refs": {} }, "GetSupportPermitOutput": { "base": null, "refs": {} }, "Integer": { "base": null, "refs": { "InternalServerException$retryAfterSeconds": "The number of seconds to wait before retrying the request.
", "ThrottlingException$retryAfterSeconds": "The number of seconds to wait before retrying the request.
" } }, "InternalServerException": { "base": "An internal service error occurred. Try again later.
", "refs": {} }, "KmsKeyArn": { "base": null, "refs": { "SigningKeyInfo$kmsKey": "The ARN of the AWS KMS key used to sign the permit. The key must have key spec ECC_NIST_P384 and key usage SIGN_VERIFY.
" } }, "ListActionsInput": { "base": null, "refs": {} }, "ListActionsOutput": { "base": null, "refs": {} }, "ListSupportPermitRequestsInput": { "base": null, "refs": {} }, "ListSupportPermitRequestsOutput": { "base": null, "refs": {} }, "ListSupportPermitsInput": { "base": null, "refs": {} }, "ListSupportPermitsOutput": { "base": null, "refs": {} }, "ListTagsForResourceInput": { "base": null, "refs": {} }, "ListTagsForResourceOutput": { "base": null, "refs": {} }, "MaxResults": { "base": null, "refs": { "ListActionsInput$maxResults": "The maximum number of results to return in a single call. Valid range is 1 to 100.
", "ListSupportPermitRequestsInput$maxResults": "The maximum number of results to return in a single call. Valid range is 1 to 100.
", "ListSupportPermitsInput$maxResults": "The maximum number of results to return in a single call. Valid range is 1 to 100.
" } }, "Name": { "base": null, "refs": { "CreateSupportPermitInput$name": "A customer-chosen name for the support permit. Must be between 1 and 256 alphanumeric characters.
", "CreateSupportPermitOutput$name": "The name of the support permit.
", "DeleteSupportPermitOutput$name": "The name of the deleted support permit.
", "GetSupportPermitOutput$name": "The name of the support permit.
", "SupportPermitSummary$name": "The name of the support permit.
" } }, "NextToken": { "base": null, "refs": { "ListActionsInput$nextToken": "The token for the next page of results.
", "ListActionsOutput$nextToken": "The token for the next page of results, or null if there are no more results.
", "ListSupportPermitRequestsInput$nextToken": "The token for the next page of results.
", "ListSupportPermitRequestsOutput$nextToken": "The token for the next page of results, or null if there are no more results.
", "ListSupportPermitsInput$nextToken": "The token for the next page of results.
", "ListSupportPermitsOutput$nextToken": "The token for the next page of results, or null if there are no more results.
" } }, "Permit": { "base": "The permit definition specifying the authorized actions, resources, and time-window conditions for a support operator.
", "refs": { "CreateSupportPermitInput$permit": "The permit definition specifying the actions, resources, and time-window conditions that the support operator is authorized to use.
", "CreateSupportPermitOutput$permit": "The permit definition.
", "DeleteSupportPermitOutput$permit": "The permit definition of the deleted permit.
", "GetSupportPermitOutput$permit": "The permit definition.
", "SupportPermitRequest$permit": "The permit definition requested by the operator.
", "SupportPermitSummary$permit": "The permit definition.
" } }, "RejectSupportPermitRequestInput": { "base": null, "refs": {} }, "RejectSupportPermitRequestOutput": { "base": null, "refs": {} }, "RequestArn": { "base": null, "refs": { "RejectSupportPermitRequestInput$requestArn": "The ARN of the permit request to reject.
", "RejectSupportPermitRequestOutput$requestArn": "The ARN of the rejected permit request.
", "SupportPermitRequest$requestArn": "The ARN of the permit request.
" } }, "Resource": { "base": null, "refs": { "Resources$member": null } }, "ResourceNotFoundException": { "base": "The specified resource does not exist.
", "refs": {} }, "ResourceSet": { "base": "The set of resources authorized by a permit. Specify either all resources in the Region or a list of specific resources.
", "refs": { "Permit$resources": "The set of resources that the support operator is authorized to act upon.
" } }, "Resources": { "base": null, "refs": { "ResourceSet$resources": "A list of specific resource identifiers that the support operator is authorized to act upon. Maximum of 5 resources.
" } }, "Service": { "base": null, "refs": { "ActionSummary$service": "The AWS service associated with the support action.
", "GetActionOutput$service": "The AWS service associated with the support action.
", "ListActionsInput$service": "The name of the AWS service for which to list available support actions.
" } }, "ServiceQuotaExceededException": { "base": "The request exceeds a service quota for your account.
", "refs": {} }, "SigningKeyInfo": { "base": "The signing key used to cryptographically sign a support permit.
", "refs": { "CreateSupportPermitInput$signingKeyInfo": "The signing key information used to sign the permit. Must reference an AWS KMS key with key usage SIGN_VERIFY and key spec ECC_NIST_P384.
", "CreateSupportPermitOutput$signingKeyInfo": "The signing key information for the permit.
", "DeleteSupportPermitOutput$signingKeyInfo": "The signing key information for the deleted permit.
", "GetSupportPermitOutput$signingKeyInfo": "The signing key information for the permit.
", "SupportPermitSummary$signingKeyInfo": "The signing key information for the permit.
" } }, "String": { "base": null, "refs": { "AccessDeniedException$message": null, "ConflictException$message": null, "ConflictException$resourceId": "The identifier of the resource that caused the conflict.
", "ConflictException$resourceType": "The type of the resource that caused the conflict.
", "InternalServerException$message": null, "ResourceNotFoundException$message": null, "ResourceNotFoundException$resourceId": "The identifier of the resource that was not found.
", "ResourceNotFoundException$resourceType": "The type of the resource that was not found.
", "ServiceQuotaExceededException$message": null, "ServiceQuotaExceededException$resourceId": "The identifier of the resource that exceeded the quota.
", "ServiceQuotaExceededException$resourceType": "The type of the resource that exceeded the quota.
", "ServiceQuotaExceededException$serviceCode": "The service code of the originating service.
", "ServiceQuotaExceededException$quotaCode": "The quota code of the exceeded quota.
", "ThrottlingException$message": null, "ValidationException$message": null, "ValidationExceptionField$path": "A JSONPointer expression to the structure member whose value failed to satisfy the modeled constraints.
", "ValidationExceptionField$message": "A detailed description of the validation failure.
" } }, "SupportCaseDisplayId": { "base": null, "refs": { "CreateSupportPermitInput$supportCaseDisplayId": "The display identifier of the AWS Support case associated with this permit.
", "CreateSupportPermitOutput$supportCaseDisplayId": "The display identifier of the support case associated with the permit.
", "DeleteSupportPermitOutput$supportCaseDisplayId": "The display identifier of the support case associated with the deleted permit.
", "GetSupportPermitOutput$supportCaseDisplayId": "The display identifier of the support case associated with the permit.
", "ListSupportPermitRequestsInput$supportCaseDisplayId": "Filters the results by support case display identifier.
", "SupportPermitRequest$supportCaseDisplayId": "The display identifier of the support case associated with the request.
", "SupportPermitSummary$supportCaseDisplayId": "The display identifier of the support case associated with the permit.
" } }, "SupportPermitIdentifier": { "base": null, "refs": { "GetSupportPermitInput$supportPermitIdentifier": "The ARN or name of the support permit to retrieve.
" } }, "SupportPermitRequest": { "base": "A permit request from an AWS support operator.
", "refs": { "SupportPermitRequests$member": null } }, "SupportPermitRequestStatus": { "base": "The status of a support permit request.
", "refs": { "SupportPermitRequest$status": "The current status of the permit request.
" } }, "SupportPermitRequests": { "base": null, "refs": { "ListSupportPermitRequestsOutput$supportPermitRequests": "The list of permit requests.
" } }, "SupportPermitStatus": { "base": "The status of a support permit.
", "refs": { "CreateSupportPermitOutput$status": "The current status of the support permit.
", "DeleteSupportPermitOutput$status": "The status of the support permit. Returns DELETING.
", "GetSupportPermitOutput$status": "The current status of the support permit.
", "SupportPermitStatuses$member": null, "SupportPermitSummary$status": "The current status of the support permit.
" } }, "SupportPermitStatuses": { "base": null, "refs": { "ListSupportPermitsInput$supportPermitStatuses": "Filters the results by support permit status. Valid values: ACTIVE, INACTIVE, DELETING.
" } }, "SupportPermitSummaries": { "base": null, "refs": { "ListSupportPermitsOutput$supportPermits": "The list of support permits.
" } }, "SupportPermitSummary": { "base": "A summary of a support permit.
", "refs": { "SupportPermitSummaries$member": null } }, "TagKey": { "base": null, "refs": { "TagKeyList$member": null, "Tags$key": null } }, "TagKeyList": { "base": null, "refs": { "UntagResourceInput$tagKeys": "The tag keys to remove from the resource.
" } }, "TagResourceInput": { "base": null, "refs": {} }, "TagResourceOutput": { "base": null, "refs": {} }, "TagValue": { "base": null, "refs": { "Tags$value": null } }, "Tags": { "base": null, "refs": { "CreateSupportPermitInput$tags": "The tags to associate with the support permit on creation.
", "CreateSupportPermitOutput$tags": "The tags associated with the support permit.
", "GetSupportPermitOutput$tags": "The tags associated with the support permit.
", "ListTagsForResourceOutput$tags": "The tags associated with the resource.
", "TagResourceInput$tags": "The tags to add to the resource. Maximum of 50 tags.
" } }, "ThrottlingException": { "base": "The request rate exceeded the allowed limit. Try again later.
", "refs": {} }, "Timestamp": { "base": null, "refs": { "Condition$allowAfter": "The earliest time at which the permit becomes valid.
", "Condition$allowBefore": "The latest time at which the permit remains valid.
", "CreateSupportPermitOutput$createdAt": "The timestamp when the permit was created.
", "DeleteSupportPermitOutput$createdAt": "The timestamp when the permit was originally created.
", "GetSupportPermitOutput$createdAt": "The timestamp when the permit was created.
", "SupportPermitRequest$createdAt": "The timestamp when the request was created.
", "SupportPermitRequest$updatedAt": "The timestamp when the request was last updated.
", "SupportPermitSummary$createdAt": "The timestamp when the permit was created.
" } }, "Unit": { "base": null, "refs": { "ActionSet$allActions": "Authorizes all available support actions.
", "ResourceSet$allResourcesInRegion": "Authorizes the support operator to act on all resources in the Region.
" } }, "UntagResourceInput": { "base": null, "refs": {} }, "UntagResourceOutput": { "base": null, "refs": {} }, "ValidationException": { "base": "The input fails to satisfy the constraints specified by the service.
", "refs": {} }, "ValidationExceptionField": { "base": "Describes one specific validation failure for an input member.
", "refs": { "ValidationExceptionFieldList$member": null } }, "ValidationExceptionFieldList": { "base": null, "refs": { "ValidationException$fieldList": "A list of fields that fail validation. Each entry identifies the field and the reason for the constraint violation.
" } } } }