Modifying the Trust Policy of a Trust Agency

Function

This API is used to modify the trust policy of a trust agency.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:agencies:updateTrustPolicyV5	Write	agency *	g:ResourceTag/<tag-key>	-	-

URI

PUT /v5/agencies/{agency_id}/trust-policy

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
agency_id	Yes	String	Definition Trust agency ID. For details about how to obtain the value, see the API for querying the agency list (ListAgenciesV5) or check the Agencies page on the IAM console. Constraints N/A Range The value can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are allowed. Default Value N/A

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
trust_policy	Yes	String	Definition JSON format of the policy document of a trust agency's trust policy. Constraints Characters =, <, >, (, ), and \| are special characters in the grammar and are not included in trust policies. The question mark (?) indicates an element is optional, for example, sid_block?. The vertical bar (\|) indicates options, and the parenthesis define the range of options, for example, ("Allow" \| "Deny"). When an element allows multiple values, use duplicate values, (,), and (...), for example, [ <policy_statement>, <policy_statement>, ... ]. The following recursive grammar describes the syntax of trust policies: policy = { <version_block>, <statement_block> } <version_block> = "Version" : ("5.0") <statement_block> = "Statement" : [ <policy_statement>, <policy_statement>, ... ] <policy_statement> = { <sid_block?>, <principal_block>, <effect_block>, <action_block>, <resource_block?>, <condition_block?> } <sid_block> = "Sid" : <sid_string> <principal_block> = ("Principal" \| "NotPrincipal") : <principal_map> <principal_map> = { <principal_map_entry>, <principal_map_entry>, ... } <principal_map_entry> = ("IAM" \| "Service" \| "Identity_provider") : [ <principal_id_string>, ... \| <service_principal_string>, ... \| <identity_provider_principal_string>, ... ] <effect_block> = "Effect" : ("Allow" \| "Deny") <action_block> = ("Action" \| "NotAction") : [ <action_string>, <action_string>, ... ] <resource_block> = ("Resource" \| "NotResource") : [ <resource_string>, <resource_string>, ... ] <condition_block> = "Condition" : { <condition_map> } <condition_map> = { <condition_type_string> : { <condition_key_string> : <condition_value_list> }, <condition_type_string> : { <condition_key_string> : <condition_value_list> }, ... } <condition_value_list> = ( <condition_value> \| [ <condition_value>, <condition_value>, ... ] ) <condition_value> = "string" Range N/A Default Value N/A

Table 2 Request body parameters

Parameter

Mandatory

Type

Description

trust_policy

Yes

String

Definition

JSON format of the policy document of a trust agency's trust policy.

Constraints

Characters =, <, >, (, ), and | are special characters in the grammar and are not included in trust policies.

The question mark (?) indicates an element is optional, for example, sid_block?.

The vertical bar (|) indicates options, and the parenthesis define the range of options, for example, ("Allow" | "Deny").

When an element allows multiple values, use duplicate values, (,), and (...), for example, [ <policy_statement>, <policy_statement>, ... ].

The following recursive grammar describes the syntax of trust policies:

policy = {
  <version_block>,
  <statement_block>
}

<version_block> = "Version" : ("5.0")

<statement_block> = "Statement" : [ <policy_statement>, <policy_statement>, ... ]

<policy_statement> = {
  <sid_block?>,
  <principal_block>,
  <effect_block>,
  <action_block>,
  <resource_block?>,
  <condition_block?>
}

<sid_block> = "Sid" : <sid_string>

<principal_block> = ("Principal" | "NotPrincipal") : <principal_map>

<principal_map> = { <principal_map_entry>, <principal_map_entry>, ... }

<principal_map_entry> = ("IAM" | "Service" | "Identity_provider") : [ <principal_id_string>, ... | <service_principal_string>, ... | <identity_provider_principal_string>, ... ]

<effect_block> = "Effect" : ("Allow" | "Deny")

<action_block> = ("Action" | "NotAction") : [ <action_string>, <action_string>, ... ]

<resource_block> = ("Resource" | "NotResource") : [ <resource_string>, <resource_string>, ... ]

<condition_block> = "Condition" : { <condition_map> }

<condition_map> = {
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  ...
}

<condition_value_list> = ( <condition_value> | [ <condition_value>, <condition_value>, ... ] )

<condition_value> = "string"

Range

N/A

Default Value

N/A

Response Parameters

Status code: 200

None

Status code: 400

**Table 3** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 403

**Table 4** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition: Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 404

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 409

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition: Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition: Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Modifying the trust policy of a trust agency

PUT https://{endpoint}/v5/agencies/{agency_id}/trust-policy

{
  "trust_policy" : "{\"Version\":\"5.0\",\"Statement\":[{\"Action\":[\"sts:agencies:assume\",\"sts::tagSession\",\"sts::setSourceIdentity\"],\"Effect\":\"Allow\",\"Principal\":{\"IAM\":[\"xxx\"]}}]}"
}