Amazon Service Catalog Service Catalog Principal API

openapi: 3.1.0
info:
  title: AWS Service Catalog Principal API
  version: '2015-12-10'
  description: Generated from AWS's published Smithy model for AWS Service Catalog. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://servicecatalog.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /#AssociatePrincipalWithPortfolio:
    post:
      operationId: AssociatePrincipalWithPortfolio
      summary: Associate Principal With Portfolio
      description: Associates the specified principal ARN with the specified portfolio. If you share the portfolio with principal
        name sharing enabled, the PrincipalARN association is included in the share. The PortfolioID, PrincipalARN, and PrincipalType
        parameters are required. You can associate a maximum of 10 Principals with a portfolio using PrincipalType as IAM_PATTERN.
        When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio
        is then shared with other accounts. For a user in a recipient account who is not an Service Catalog Admin, but still
        has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal
        name association for the portfolio. Although this user may not know which principal names are associated through Service
        Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog
        recommends using PrincipalType as IAM. With this configuration, the PrincipalARN must already exist in the recipient
        account before it can be associated.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AssociatePrincipalWithPortfolioOutput'
        '400':
          description: InvalidParametersException; LimitExceededException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParametersException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWS242ServiceCatalogService.AssociatePrincipalWithPortfolio
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/AssociatePrincipalWithPortfolioInput'
      tags:
      - Principal
  /#DisassociatePrincipalFromPortfolio:
    post:
      operationId: DisassociatePrincipalFromPortfolio
      summary: Disassociate Principal From Portfolio
      description: 'Disassociates a previously associated principal ARN from a specified portfolio. The PrincipalType and
        PrincipalARN must match the AssociatePrincipalWithPortfolio call request details. For example, to disassociate an
        association created with a PrincipalARN of PrincipalType IAM you must use the PrincipalType IAM when calling DisassociatePrincipalFromPortfolio.
        For portfolios that have been shared with principal name sharing enabled: after disassociating a principal, share
        recipient accounts will no longer be able to provision products in this portfolio using a role matching the name of
        the associated principal. For more information, review associate-principal-with-portfolio in the Amazon Web Services
        CLI Command Reference. If you disassociate a principal from a portfolio, with PrincipalType as IAM, the same principal
        will still have access to the portfolio if it matches one of the associated principals of type IAM_PATTERN. To fully
        remove access for a principal, verify all the associated Principals of type IAM_PATTERN, and then ensure you disassociate
        any IAM_PATTERN principals that match the principal whose access you are removing.'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DisassociatePrincipalFromPortfolioOutput'
        '400':
          description: InvalidParametersException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParametersException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWS242ServiceCatalogService.DisassociatePrincipalFromPortfolio
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DisassociatePrincipalFromPortfolioInput'
      tags:
      - Principal
  /#ListPrincipalsForPortfolio:
    post:
      operationId: ListPrincipalsForPortfolio
      summary: List Principals For Portfolio
      description: Lists all PrincipalARNs and corresponding PrincipalTypes associated with the specified portfolio.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListPrincipalsForPortfolioOutput'
        '400':
          description: InvalidParametersException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParametersException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWS242ServiceCatalogService.ListPrincipalsForPortfolio
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListPrincipalsForPortfolioInput'
      tags:
      - Principal
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: servicecatalog
  schemas:
    AssociatePrincipalWithPortfolioInput:
      type: object
      properties:
        AcceptLanguage:
          type: string
          description: The language code. jp - Japanese zh - Chinese
        PortfolioId:
          type: string
          description: The portfolio identifier.
        PrincipalARN:
          type: string
          description: 'The ARN of the principal (user, role, or group). If the PrincipalType is IAM, the supported value
            is a fully defined IAM Amazon Resource Name (ARN). If the PrincipalType is IAM_PATTERN, the supported value is
            an IAM ARN without an AccountID in the following format: arn:partition:iam:::resource-type/resource-id The ARN
            resource-id can be either: A fully formed resource-id. For example, arn:aws:iam:::role/resource-name or arn:aws:iam:::role/resource-path/resource-name
            A wildcard ARN. The wildcard ARN accepts IAM_PATTERN values with a "*" or "?" in the resource-id segment of the
            ARN. For example '
        PrincipalType:
          type: string
          enum:
          - IAM
          - IAM_PATTERN
          description: The principal type. The supported value is IAM if you use a fully defined Amazon Resource Name (ARN),
            or IAM_PATTERN if you use an ARN with no accountID, with or without wildcard characters.
      required:
      - PortfolioId
      - PrincipalARN
      - PrincipalType
    AssociatePrincipalWithPortfolioOutput:
      type: object
      properties: {}
    DisassociatePrincipalFromPortfolioInput:
      type: object
      properties:
        AcceptLanguage:
          type: string
          description: The language code. jp - Japanese zh - Chinese
        PortfolioId:
          type: string
          description: The portfolio identifier.
        PrincipalARN:
          type: string
          description: The ARN of the principal (user, role, or group). This field allows an ARN with no accountID with or
            without wildcard characters if PrincipalType is IAM_PATTERN.
        PrincipalType:
          type: string
          enum:
          - IAM
          - IAM_PATTERN
          description: The supported value is IAM if you use a fully defined ARN, or IAM_PATTERN if you specify an IAM ARN
            with no AccountId, with or without wildcard characters.
      required:
      - PortfolioId
      - PrincipalARN
    DisassociatePrincipalFromPortfolioOutput:
      type: object
      properties: {}
    InvalidParametersException:
      type: object
      properties:
        Message:
          type: string
    ListPrincipalsForPortfolioInput:
      type: object
      properties:
        AcceptLanguage:
          type: string
          description: The language code. jp - Japanese zh - Chinese
        PortfolioId:
          type: string
          description: The portfolio identifier.
        PageSize:
          type: integer
          description: The maximum number of items to return with this call.
        PageToken:
          type: string
          description: The page token for the next set of results. To retrieve the first set of results, use null.
      required:
      - PortfolioId
    ListPrincipalsForPortfolioOutput:
      type: object
      properties:
        Principals:
          type: array
          items:
            $ref: '#/components/schemas/Principal'
          description: The PrincipalARNs and corresponding PrincipalTypes associated with the portfolio.
        NextPageToken:
          type: string
          description: The page token to use to retrieve the next set of results. If there are no additional results, this
            value is null.
    Principal:
      type: object
      properties:
        PrincipalARN:
          type: string
          description: The ARN of the principal (user, role, or group). This field allows for an ARN with no accountID, with
            or without wildcard characters if the PrincipalType is an IAM_PATTERN. For more information, review associate-principal-with-portfolio
            in the Amazon Web Services CLI Command Reference.
        PrincipalType:
          type: string
          enum:
          - IAM
          - IAM_PATTERN
          description: The principal type. The supported value is IAM if you use a fully defined ARN, or IAM_PATTERN if you
            use an ARN with no accountID, with or without wildcard characters.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/service-catalog/service/2015-12-10/service-catalog-2015-12-10.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)