get_aws_system_role_details¶

ConsoleAccessApi.get_aws_system_role_details(id, role_id, switch_console=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)¶

Get AWS console role details or start a console session

Without switch-console, returns role details including RolePermissions. Missing RoleId raises GE-1034 as GenericFailure → HTTP 500. With switch-console=true, returns {PresignedUrl} for a federated AWS console session if the caller is in UsersAttached (else AUTH-1002). Any other switch-console value returns IPV-1045. Missing role_id header returns AUTH-1001.

Parameters:

id (str) – RoleId of the AWS console access role. (required)
role_id (str) – Amorphic role ID used for authorization. (required)
switch_console (str) – Set to true to return PresignedUrl instead of role details. Presence of the query key enables console mode; value must be exactly true (else IPV-1045).
_request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.
_request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.
_content_type (str, Optional) – force content-type for the request.
_headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.
_host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

GetAwsRoleByIdResponse

Returns:

Returns the result object.

Request and Response Examples¶

HTTP: GET /aws-roles/{id}

Success (HTTP 200)¶

AwsRoleDetails, or AwsRoleConsoleSession when switch-console=true.

Role details with permissions

{
  "RoleId": "sys-readonly",
  "RoleName": "SystemRole-readonly",
  "RoleArn": "arn:aws:iam::123456789012:role/proj-dev-SystemRole-readonly",
  "UsersAttached": [
    "user1"
  ],
  "IsSystemGeneratedRole": true,
  "RolePermissions": {
    "Version": "2012-10-17",
    "Statement": []
  }
}

switch-console=true

{
  "PresignedUrl": "https://signin.aws.amazon.com/federation?Action=login&..."
}

Errors¶

Documented error codes: AUTH-1001, AUTH-1002, IPV-1045, GE-1034.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”}. Common codes: AUTH-1001, AUTH-1002 (not in UsersAttached for console session), IPV-1045 (switch-console not true).

User not attached for console switch

{
  "Message": "AUTH-1002 - User action is not permitted"
}

switch-console not true

{
  "Message": "IPV-1045 - Invalid parameter - false, value either missing or is invalid."
}

HTTP 500

Backend failure. Missing RoleId for details uses GE-1034 (GenericFailure) → HTTP 500: “GE-1034 - There’s no role with specified RoleId, Please check RoleId and try again”. switch-console with missing role may KeyError into a bare exception Message. Other failures return exception text.

RoleId not found (details GET)

{
  "Message": "GE-1034 - There's no role with specified RoleId, Please check RoleId and try again"
}