ACCOUNTACCESS

2 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

AccountAccessApplication # CLOUD CONTROL · AWS::AccountAccess::Application

AccountAccessApplication manages AWS::AccountAccess::Application through the AWS Cloud Control API.

kubectl get accountaccessapplications · example on GitHub

Example

# AccountAccessApplication — accountaccess
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/accountaccess.html#accountaccessapplication
apiVersion: aws.konfig.io/v1alpha1
kind: AccountAccessApplication
metadata:
  name: example-accountaccessapplication
  namespace: default
spec:
  identitySource:
    identityCenter:
      applicationArn: arn:aws:iam::123456789012:role/example-role
      instanceArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-accountaccessapplication
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`identitySource`	object	yes	The identity source for the application Create-only in AWS: changing it requires replacing the resource.
`identitySource.identityCenter`	object	yes	AccountAccessApplicationIdentityCenter is a nested property type of AWS::AccountAccess::Application.
`identitySource.identityCenter.applicationArn`	string	—	The ARN of the associated Identity Center application
`identitySource.identityCenter.instanceArn`	string	yes	The ARN of the Identity Center instance
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`applicationArn`	string	—	The ARN of the application Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the application was created Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the application Read-only: reported by AWS after creation. Allowed: `CREATE_IN_PROGRESS, ACTIVE, DELETE_IN_PROGRESS, CREATE_FAILED, DELETE_FAILED`
`tenantId`	string	—	The tenant ID of the application Read-only: reported by AWS after creation.
`updatedAt`	string	—	The timestamp when the application was last updated Read-only: reported by AWS after creation.

AccountAccessEntitlement # CLOUD CONTROL · AWS::AccountAccess::Entitlement

AccountAccessEntitlement manages AWS::AccountAccess::Entitlement through the AWS Cloud Control API.

kubectl get accountaccessentitlements · example on GitHub

Example

# AccountAccessEntitlement — accountaccess
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/accountaccess.html#accountaccessentitlement
apiVersion: aws.konfig.io/v1alpha1
kind: AccountAccessEntitlement
metadata:
  name: example-accountaccessentitlement
  namespace: default
spec:
  applicationArn: arn:aws:iam::123456789012:role/example-role
  entitlement:
    principalRole:
      account: example
      roleArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-accountaccessentitlement
    region: us-east-1

Spec

Field	Type	Required	Description
`applicationArn`	string	yes	The ARN of the application Create-only in AWS: changing it requires replacing the resource.
`entitlement`	object	yes	The entitlement details Create-only in AWS: changing it requires replacing the resource.
`entitlement.principalRole`	object	yes	AccountAccessEntitlementPrincipalRoleEntitlement is a nested property type of AWS::AccountAccess::Entitlement.
`entitlement.principalRole.account`	string	—	The AWS account ID
`entitlement.principalRole.principal`	object	yes	AccountAccessEntitlementPrincipal is a nested property type of AWS::AccountAccess::Entitlement.
`entitlement.principalRole.principal.identityCenter`	object	yes	AccountAccessEntitlementIdentityCenterPrincipal is a nested property type of AWS::AccountAccess::Entitlement.
`entitlement.principalRole.principal.identityCenter.groupId`	string	—	The ID of the group
`entitlement.principalRole.principal.identityCenter.userId`	string	—	The ID of the user
`entitlement.principalRole.roleArn`	string	yes	The ARN of the IAM role
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp when the entitlement was created Read-only: reported by AWS after creation.
`entitlementId`	string	—	The ID of the entitlement Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.