Creating a Trust Agency

iam:agencies:createV5

Write

agency *

-

-

-

agency_name

Yes

String

Definition:

Name of a trust agency.

Constraints:

The value contains 1 to 64 characters. Only letters, digits, underscores (_), plus signs (+), equal signs (=), commas (,), periods (.), at signs (@), and hyphens (-) are allowed.

Range:

N/A

Default Value:

N/A

path

No

String

Definition:

Resource path.

Constraints:

The value consists of several character strings. Each character string contains one or more letters, digits, periods (.), commas (,), plus signs (+), at signs (@), equal signs (=), underscores (_), or hyphens (-), and ends with a slash (/), for example, foo/bar/.

The value contains 0 to 512 characters.

Range:

N/A

Default Value:

The value is an empty string by default.

trust_policy

Yes

String

Definition

JSON format of the policy document of a trust agency's trust policy.

Constraints

Characters =, <, >, (, ), and | are special characters in the grammar and are not included in trust policies.

The question mark (?) indicates an element is optional, for example, sid_block?.

The vertical bar (|) indicates options, and the parenthesis define the range of options, for example, ("Allow" | "Deny").

When an element allows multiple values, use duplicate values, (,), and (...), for example, [ <policy_statement>, <policy_statement>, ... ].

The following recursive grammar describes the syntax of trust policies:

policy = {
  <version_block>,
  <statement_block>
}

<version_block> = "Version" : ("5.0")

<statement_block> = "Statement" : [ <policy_statement>, <policy_statement>, ... ]

<policy_statement> = {
  <sid_block?>,
  <principal_block>,
  <effect_block>,
  <action_block>,
  <resource_block?>,
  <condition_block?>
}

<sid_block> = "Sid" : <sid_string>

<principal_block> = ("Principal" | "NotPrincipal") : <principal_map>

<principal_map> = { <principal_map_entry>, <principal_map_entry>, ... }

<principal_map_entry> = ("IAM" | "Service" | "Identity_provider") : [ <principal_id_string>, ... | <service_principal_string>, ... | <identity_provider_principal_string>, ... ]

<effect_block> = "Effect" : ("Allow" | "Deny")

<action_block> = ("Action" | "NotAction") : [ <action_string>, <action_string>, ... ]

<resource_block> = ("Resource" | "NotResource") : [ <resource_string>, <resource_string>, ... ]

<condition_block> = "Condition" : { <condition_map> }

<condition_map> = {
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  ...
}

<condition_value_list> = ( <condition_value> | [ <condition_value>, <condition_value>, ... ] )

<condition_value> = "string"

Range

N/A

Default Value

N/A

max_session_duration

No

Integer

Definition:

Maximum session duration of a trust agency, in seconds.

Constraints:

N/A

Range:

The value ranges from 3,600 to 43,200.

Default Value:

The default value is 3600.

description

No

String

Definition:

Description of a trust agency.

Constraints:

The value contains 0 to 1,000 characters.

Range:

N/A

Default Value:

The value is an empty string by default.

agency

agency object

Definition:

Trust agency.

Range:

N/A

urn

String

Definition :

Uniform Resource Name (URN). For details, see Reference.

Range:

N/A.

trust_policy

String

Definition:

JSON format of the policy document of a trust agency's trust policy.

Range:

N/A

created_at

String

Definition:

Time when a trust agency is created.

Range:

N/A

description

String

Definition:

Description of a trust agency.

Range:

N/A

max_session_duration

Integer

Definition:

Maximum session duration of a trust agency, in seconds.

Range:

The value ranges from 3,600 to 43,200.

path

String

Definition:

Resource path.

Range:

N/A

agency_id

String

Definition:

Trust agency ID.

Range:

N/A

agency_name

String

Definition:

Name of a trust agency.

Range:

N/A

trust_domain_id

String

Definition:

ID of the delegated account.

Range:

N/A

trust_domain_name

String

Definition:

Name of the delegated account.

Range:

N/A

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is PAP5.XXXX, for example, PAP5.0012.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

request_id

String

Definition:

Unique identifier of an API request, which is used to locate API calling exceptions.

Range:

N/A

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is PAP5.XXXX, for example, PAP5.0012.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

request_id

String

Definition:

Unique identifier of an API request, which is used to locate API calling exceptions.

Range:

N/A

encoded_authorization_message

String

Definition :

Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link.

Range:

N/A.

error_code

String

Definition :

Error code. For details, see Error Code.

Range:

The format is PAP5.XXXX, for example, PAP5.0012.

error_msg

String

Definition :

Error message. For details, see Error Message.

Range:

N/A.

request_id

String

Definition:

Unique identifier of an API request, which is used to locate API calling exceptions.

Range:

N/A

201

Successful

400

Bad request

403

Forbidden

409

Conflict