java.lang.Object
- com.pulumi.resources.Resource
- - com.pulumi.resources.CustomResource
  - - com.pulumi.aws.accountaccess.Entitlement

public class Entitlement
extends com.pulumi.resources.CustomResource

Manages an AWS Account Access Entitlement. An Entitlement grants an IAM Identity Center principal the ability to assume a specific IAM role in a target AWS account through an Account Access Application. > **Note:** Entitlements are immutable. Changing `applicationArn` or `entitlement` triggers replacement. > **Note:** The IAM role referenced by `entitlement.principal_role.role_arn` must have a trust policy that allows the Account Access service to assume it. The role's `assumeRolePolicy` must grant `sts:AssumeRole`, `sts:SetContext`, and `sts:TagSession` to the `account-access.amazonaws.com` service principal. Without `sts:TagSession`, credential retrieval for the entitlement fails. See the Complete Example below. ## Example Usage ### User Principal

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.accountaccess.Entitlement;
 import com.pulumi.aws.accountaccess.EntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Entitlement("example", EntitlementArgs.builder()
             .entitlement(EntitlementEntitlementArgs.builder()
                 .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                     .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                         .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                             .userId("11111111-2222-3333-4444-555555555555")
                             .build())
                         .build())
                     .roleArn("arn:aws:iam::123456789012:role/Developer")
                     .build())
                 .build())
             .applicationArn(exampleAwsAccountaccessApplication.arn())
             .build());
 
     }
 }

### Group Principal

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.accountaccess.Entitlement;
 import com.pulumi.aws.accountaccess.EntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Entitlement("example", EntitlementArgs.builder()
             .entitlement(EntitlementEntitlementArgs.builder()
                 .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                     .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                         .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                             .groupId("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee")
                             .build())
                         .build())
                     .roleArn("arn:aws:iam::123456789012:role/Engineering")
                     .build())
                 .build())
             .applicationArn(exampleAwsAccountaccessApplication.arn())
             .build());
 
     }
 }

### Complete Example The target IAM role must trust the Account Access service. This example provisions a role with the required trust policy and grants an entitlement to it.

 
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.ssoadmin.SsoadminFunctions;
 import com.pulumi.aws.ssoadmin.inputs.GetInstancesArgs;
 import com.pulumi.aws.accountaccess.Application;
 import com.pulumi.aws.accountaccess.ApplicationArgs;
 import com.pulumi.aws.accountaccess.inputs.ApplicationIdentitySourceArgs;
 import com.pulumi.aws.accountaccess.inputs.ApplicationIdentitySourceIdentityCenterArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.accountaccess.Entitlement;
 import com.pulumi.aws.accountaccess.EntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
 import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
 import static com.pulumi.codegen.internal.Serialization.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var example = SsoadminFunctions.getInstances(GetInstancesArgs.builder()
             .build());
 
         var exampleApplication = new Application("exampleApplication", ApplicationArgs.builder()
             .identitySource(ApplicationIdentitySourceArgs.builder()
                 .identityCenter(ApplicationIdentitySourceIdentityCenterArgs.builder()
                     .instanceArn(example.arns()[0])
                     .build())
                 .build())
             .build());
 
         // The target role must allow the Account Access service to assume it.
         // sts:TagSession is required for credential retrieval to succeed.
         var target = new Role("target", RoleArgs.builder()
             .name("example-account-access-developer")
             .assumeRolePolicy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Principal", jsonObject(
                             jsonProperty("Service", "account-access.amazonaws.com")
                         )),
                         jsonProperty("Action", jsonArray(
                             "sts:AssumeRole", 
                             "sts:SetContext", 
                             "sts:TagSession"
                         ))
                     )))
                 )))
             .build());
 
         var exampleEntitlement = new Entitlement("exampleEntitlement", EntitlementArgs.builder()
             .entitlement(EntitlementEntitlementArgs.builder()
                 .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                     .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                         .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                             .userId("11111111-2222-3333-4444-555555555555")
                             .build())
                         .build())
                     .roleArn(target.arn())
                     .build())
                 .build())
             .applicationArn(exampleApplication.arn())
             .build());
 
     }
 }

## Import ### Identity Schema #### Required * `applicationArn` (String) ARN of the parent Account Access Application. * `entitlementId` (String) Service-assigned unique identifier for this Entitlement. #### Optional * `accountId` (String) AWS Account where this resource is managed. * `region` (String) Region where this resource is managed. Using `pulumi import`, import Account Access Entitlements using the composite ID. For example: ```sh $ pulumi import aws:accountaccess/entitlement:Entitlement example arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef,ent-0123456789abcdef ```

Nested Class Summary
- Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource
  com.pulumi.resources.CustomResource.CustomResourceInternal
- Nested classes/interfaces inherited from class com.pulumi.resources.Resource
  com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

Field Summary
- Fields inherited from class com.pulumi.resources.Resource
  childResources, remote

Constructor Summary

Constructors
Constructor	Description
`Entitlement(java.lang.String name)`
`Entitlement(java.lang.String name, EntitlementArgs args)`
`Entitlement(java.lang.String name, EntitlementArgs args, com.pulumi.resources.CustomResourceOptions options)`

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`com.pulumi.core.Output<java.lang.String>`	`applicationArn()`
`com.pulumi.core.Output<EntitlementEntitlement>`	`entitlement()`
`com.pulumi.core.Output<java.lang.String>`	`entitlementId()`
`static Entitlement`	`get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, EntitlementState state, com.pulumi.resources.CustomResourceOptions options)`	Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
`com.pulumi.core.Output<java.lang.String>`	`region()`

Methods inherited from class com.pulumi.resources.CustomResource
getId, id, idFuture

Methods inherited from class com.pulumi.resources.Resource
getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - Entitlement
```
public Entitlement(java.lang.String name)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
  - Entitlement
```
public Entitlement(java.lang.String name,
                   EntitlementArgs args)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
  - Entitlement
```
public Entitlement(java.lang.String name,
                   EntitlementArgs args,
                   @Nullable
                   com.pulumi.resources.CustomResourceOptions options)
```
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    args - The arguments to use to populate this resource's properties.
    
    options - A bag of options that control this resource's behavior.
- Method Detail
  - applicationArn
```
public com.pulumi.core.Output<java.lang.String> applicationArn()
```
    Returns:
    
    ARN of the parent Account Access Application. Forces replacement when changed.
  - entitlement
```
public com.pulumi.core.Output<EntitlementEntitlement> entitlement()
```
    Returns:
    
    Entitlement configuration. See `entitlement` Block below. The following arguments are optional:
  - entitlementId
```
public com.pulumi.core.Output<java.lang.String> entitlementId()
```
    Returns:
    
    Service-assigned unique identifier for this Entitlement.
  - region
```
public com.pulumi.core.Output<java.lang.String> region()
```
    Returns:
    
    Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
  - get
```
public static Entitlement get(java.lang.String name,
                              com.pulumi.core.Output<java.lang.String> id,
                              @Nullable
                              EntitlementState state,
                              @Nullable
                              com.pulumi.resources.CustomResourceOptions options)
```
    Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
    
    Parameters:
    
    name - The _unique_ name of the resulting resource.
    
    id - The _unique_ provider ID of the resource to lookup.
    
    state -
    
    options - Optional settings to control the behavior of the CustomResource.

Class Entitlement

Nested Class Summary

Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

Nested classes/interfaces inherited from class com.pulumi.resources.Resource

Field Summary

Fields inherited from class com.pulumi.resources.Resource

Constructor Summary

Method Summary

Methods inherited from class com.pulumi.resources.CustomResource

Methods inherited from class com.pulumi.resources.Resource

Methods inherited from class java.lang.Object

Constructor Detail

Entitlement

Entitlement

Entitlement

Method Detail

applicationArn

entitlement

entitlementId

region

get