Modifying the Trust Policy of a Trust Agency

Function

This API is used to modify the trust policy of a trust agency.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:agencies:updateTrustPolicyV5	Write	agency *	g:ResourceTag/<tag-key>	-	-

URI

PUT /v5/agencies/{agency_id}/trust-policy

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
agency_id	Yes	String	Definition: Trust agency ID. Constraints: The value can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are allowed. Range: N/A Default Value: N/A

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
trust_policy	Yes	String	Definition JSON format of the policy document of a trust agency's trust policy. Constraints Characters =, <, >, (, ), and \| are special characters in the grammar and are not included in trust policies. The question mark (?) indicates an element is optional, for example, sid_block?. The vertical bar (\|) indicates options, and the parenthesis define the range of options, for example, ("Allow" \| "Deny"). When an element allows multiple values, use duplicate values, (,), and (...), for example, [ <policy_statement>, <policy_statement>, ... ]. The following recursive grammar describes the syntax of trust policies: policy = { <version_block>, <statement_block> } <version_block> = "Version" : ("5.0") <statement_block> = "Statement" : [ <policy_statement>, <policy_statement>, ... ] <policy_statement> = { <sid_block?>, <principal_block>, <effect_block>, <action_block>, <resource_block?>, <condition_block?> } <sid_block> = "Sid" : <sid_string> <principal_block> = ("Principal" \| "NotPrincipal") : <principal_map> <principal_map> = { <principal_map_entry>, <principal_map_entry>, ... } <principal_map_entry> = ("IAM" \| "Service" \| "Identity_provider") : [ <principal_id_string>, ... \| <service_principal_string>, ... \| <identity_provider_principal_string>, ... ] <effect_block> = "Effect" : ("Allow" \| "Deny") <action_block> = ("Action" \| "NotAction") : [ <action_string>, <action_string>, ... ] <resource_block> = ("Resource" \| "NotResource") : [ <resource_string>, <resource_string>, ... ] <condition_block> = "Condition" : { <condition_map> } <condition_map> = { <condition_type_string> : { <condition_key_string> : <condition_value_list> }, <condition_type_string> : { <condition_key_string> : <condition_value_list> }, ... } <condition_value_list> = ( <condition_value> \| [ <condition_value>, <condition_value>, ... ] ) <condition_value> = "string" Range N/A Default Value N/A

Table 2 Request body parameters

Parameter

Mandatory

Type

Description

trust_policy

Yes

String

Definition

JSON format of the policy document of a trust agency's trust policy.

Constraints

Characters =, <, >, (, ), and | are special characters in the grammar and are not included in trust policies.

The question mark (?) indicates an element is optional, for example, sid_block?.

The vertical bar (|) indicates options, and the parenthesis define the range of options, for example, ("Allow" | "Deny").

When an element allows multiple values, use duplicate values, (,), and (...), for example, [ <policy_statement>, <policy_statement>, ... ].

The following recursive grammar describes the syntax of trust policies:

policy = {
  <version_block>,
  <statement_block>
}

<version_block> = "Version" : ("5.0")

<statement_block> = "Statement" : [ <policy_statement>, <policy_statement>, ... ]

<policy_statement> = {
  <sid_block?>,
  <principal_block>,
  <effect_block>,
  <action_block>,
  <resource_block?>,
  <condition_block?>
}

<sid_block> = "Sid" : <sid_string>

<principal_block> = ("Principal" | "NotPrincipal") : <principal_map>

<principal_map> = { <principal_map_entry>, <principal_map_entry>, ... }

<principal_map_entry> = ("IAM" | "Service" | "Identity_provider") : [ <principal_id_string>, ... | <service_principal_string>, ... | <identity_provider_principal_string>, ... ]

<effect_block> = "Effect" : ("Allow" | "Deny")

<action_block> = ("Action" | "NotAction") : [ <action_string>, <action_string>, ... ]

<resource_block> = ("Resource" | "NotResource") : [ <resource_string>, <resource_string>, ... ]

<condition_block> = "Condition" : { <condition_map> }

<condition_map> = {
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  ...
}

<condition_value_list> = ( <condition_value> | [ <condition_value>, <condition_value>, ... ] )

<condition_value> = "string"

Range

N/A

Default Value

N/A

Response Parameters

Status code: 200

Successful

Status code: 400

**Table 3** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 403

**Table 4** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition : Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 404

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 409

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Modifying the trust policy of a trust agency

PUT https://{endpoint}/v5/agencies/{agency_id}/trust-policy

{
  "trust_policy" : "{\"Version\":\"5.0\",\"Statement\":[{\"Action\":[\"sts:agencies:assume\",\"sts::tagSession\",\"sts::setSourceIdentity\"],\"Effect\":\"Allow\",\"Principal\":{\"IAM\":[\"xxx\"]}}]}"
}