Console Access

APIs related to switching to aws console from amorphic

📄️ List AWS console access roles

Returns AWS console access roles (system and custom) from the console-access roles table. Requires role_id header (else AUTH-1001). Pagination via sort_page_in_code: offset is 1-based (converted to offset-1; omitted starts at 0); limit defaults to 100, max 500 (else IPV-1050). sortorder defaults to desc; sortby defaults to LastModifiedTime (value must be a string field on each item). Optional projectionExpression filters attributes. Response keys: roles, count, total_count, next_available ('yes' or 'no'). Last page when next_available is 'no'.

📄️ Sync custom AWS IAM roles from S3

Starts an asynchronous sync of custom AWS IAM roles from policy documents under the Amorphic core S3 custom-roles prefix. The API returns immediately after Event-invoking this Lambda with invoke_type=async; the async run creates/updates/deletes custom roles to match templates and emails admins. Success Message is 'Custom roles actions started, You'll get an email about the details of custom role actions.' Not idempotent in effect (each call triggers a new sync). Requires role_id (AUTH-1001 if missing).

📄️ Get AWS console role details or start a console session

Without switch-console, returns role details including RolePermissions. Missing RoleId raises GE-1034 as GenericFailure → HTTP 500. With switch-console=true, returns {PresignedUrl} for a federated AWS console session if the caller is in UsersAttached (else AUTH-1002). Any other switch-console value returns IPV-1045. Missing role_id header returns AUTH-1001.

📄️ Delete a custom AWS console access role

Deletes a custom AWS console access role: DynamoDB item, IAM role, and S3 policy document. System roles cannot be deleted (GE-1034 → HTTP 500). Custom roles with UsersAttached cannot be deleted (GE-1034 → HTTP 500). Missing RoleId also GE-1034 → 500. Success Message is 'Custom AWS role deleted successfully'. DynamoDB delete failure returns DB-1003 (400). IAM/S3 failures return GE-1034/GE-1032 as GenericFailure → 500. Not idempotent after success.

📄️ Update users attached to an AWS console access role

Replaces UsersAttached on the role. Required body key UsersAttached (else IPV-1038). Empty list detaches all users. Each listed user must be valid and active (else GE-1034 → HTTP 500). Missing RoleId → GE-1034 HTTP 500. Updates each user's AwsRoles map and the console-access roles table. Success Message is 'User access on role updated successfully!'. Role name, description, and permissions are not editable here.