aws-sdk-managedgrafana 1.12.0 → 1.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dbed3c483cb41a8ed9c42655e36beb415da0a7c1a45e21ad77554152ebd627fd
-  data.tar.gz: cfa5fb3b3859d7c141652054436061144dea64c925d9f629b4db914cc0c5e89c
+  metadata.gz: 95d1063eedc2551fd155e40eaa7b6bd779a0985a40b02bd76b0340793c0b8cc3
+  data.tar.gz: 8bf298a66f196a2e7cac0b6975d77569d1836221f2498a21db297b0f9a2ccb53
 SHA512:
-  metadata.gz: 026314fed6e3710f307837edf8daf8b965133b2b3289f7b95befe1503bf0c4b6e79df1f6ada184ef77c59a0b7ee27faa58212f6bb73247be025fe88d7e199472
-  data.tar.gz: bef0e55956c9c8b6d9ad29a882e0b35018f59c68aebc0ad31ce3bacf0e04807f80af4d65ae2ec6e276b5086705d6a6e334a07b20a3e5c40b4293fca37f2d331b
+  metadata.gz: d96a64a32df7817926d52f10c648433c0bf1c52817536dadfb3cde8e14865b830aa0640fd483cda412d736e9a62e2b591c27d52735b747d6076a500aef4802c0
+  data.tar.gz: 9f3bdc522883c556b465a803f98728cc443f9a7d65c6bf9a72e20151c28791695e83060183faa1e032010bfceb9c19acccda97d1cb587bc7fd9f54e8220fb955

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.13.0 (2023-02-23)
+------------------
+
+* Feature - Doc-only update. Updated information on attached role policies for customer provided roles
+
 1.12.0 (2023-02-16)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.12.0
+1.13.0

data/lib/aws-sdk-managedgrafana/client.rb

@@ -508,22 +508,23 @@ module Aws::ManagedGrafana
     #   in other accounts in an organization.
     #
     # @option params [required, String] :permission_type
-    #   If you specify `SERVICE_MANAGED` on AWS Grafana console, Amazon
-    #   Managed Grafana automatically creates the IAM roles and provisions the
-    #   permissions that the workspace needs to use Amazon Web Services data
-    #   sources and notification channels. In the CLI mode, the permissionType
-    #   `SERVICE_MANAGED` will not create the IAM role for you. The ability
-    #   for the Amazon Managed Grafana to create the IAM role on behalf of the
-    #   user is supported only in the Amazon Managed Grafana AWS console. Use
-    #   only the `CUSTOMER_MANAGED` permission type when creating a workspace
-    #   in the CLI.
-    #
-    #   If you specify `CUSTOMER_MANAGED`, you will manage those roles and
-    #   permissions yourself. If you are creating this workspace in a member
-    #   account of an organization that is not a delegated administrator
-    #   account, and you want the workspace to access data sources in other
-    #   Amazon Web Services accounts in the organization, you must choose
-    #   `CUSTOMER_MANAGED`.
+    #   When creating a workspace through the Amazon Web Services API, CLI or
+    #   Amazon Web Services CloudFormation, you must manage IAM roles and
+    #   provision the permissions that the workspace needs to use Amazon Web
+    #   Services data sources and notification channels.
+    #
+    #   You must also specify a `workspaceRoleArn` for a role that you will
+    #   manage for the workspace to use when accessing those datasources and
+    #   notification channels.
+    #
+    #   The ability for Amazon Managed Grafana to create and update IAM roles
+    #   on behalf of the user is supported only in the Amazon Managed Grafana
+    #   console, where this value may be set to `SERVICE_MANAGED`.
+    #
+    #   <note markdown="1"> Use only the `CUSTOMER_MANAGED` permission type when creating a
+    #   workspace with the API, CLI or Amazon Web Services CloudFormation.
+    #
+    #    </note>
     #
     #   For more information, see [Amazon Managed Grafana permissions and
     #   policies for Amazon Web Services data sources and notification
@@ -545,15 +546,7 @@ module Aws::ManagedGrafana
     #   sources for your Grafana workspace to connect to.
     #
     # @option params [Array<String>] :workspace_data_sources
-    #   Specify the Amazon Web Services data sources that you want to be
-    #   queried in this workspace. Specifying these data sources here enables
-    #   Amazon Managed Grafana to create IAM roles and permissions that allow
-    #   Amazon Managed Grafana to read data from these sources. You must still
-    #   add them as data sources in the Grafana console in the workspace.
-    #
-    #   If you don't specify a data source here, you can still add it as a
-    #   data source in the workspace console later. However, you will then
-    #   have to manually configure permissions for it.
+    #   This parameter is for internal use only, and should not be used.
     #
     # @option params [String] :workspace_description
     #   A description for the workspace. This is used only to help you
@@ -576,10 +569,11 @@ module Aws::ManagedGrafana
     #   of an organization.
     #
     # @option params [String] :workspace_role_arn
-    #   The workspace needs an IAM role that grants permissions to the Amazon
-    #   Web Services resources that the workspace will view data from. If you
-    #   already have a role that you want to use, specify it here. The
-    #   permission type should be set to `CUSTOMER_MANAGED`.
+    #   Specified the IAM role that grants permissions to the Amazon Web
+    #   Services resources that the workspace will view data from, including
+    #   both data sources and notification channels. You are responsible for
+    #   managing the permissions for this role as new data sources or
+    #   notification channels are added.
     #
     # @return [Types::CreateWorkspaceResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -1325,28 +1319,41 @@ module Aws::ManagedGrafana
     #
     # @option params [String] :organization_role_name
     #   The name of an IAM role that already exists to use to access resources
-    #   through Organizations.
+    #   through Organizations. This can only be used with a workspace that has
+    #   the `permissionType` set to `CUSTOMER_MANAGED`.
     #
     # @option params [String] :permission_type
-    #   If you specify `SERVICE_MANAGED`, Amazon Managed Grafana automatically
-    #   creates the IAM roles and provisions the permissions that the
-    #   workspace needs to use Amazon Web Services data sources and
-    #   notification channels.
+    #   Use this parameter if you want to change a workspace from
+    #   `SERVICE_MANAGED` to `CUSTOMER_MANAGED`. This allows you to manage the
+    #   permissions that the workspace uses to access datasources and
+    #   notification channels. If the workspace is in a member Amazon Web
+    #   Services account of an organization, and that account is not a
+    #   delegated administrator account, and you want the workspace to access
+    #   data sources in other Amazon Web Services accounts in the
+    #   organization, you must choose `CUSTOMER_MANAGED`.
     #
-    #   If you specify `CUSTOMER_MANAGED`, you will manage those roles and
-    #   permissions yourself. If you are creating this workspace in a member
-    #   account of an organization and that account is not a delegated
-    #   administrator account, and you want the workspace to access data
-    #   sources in other Amazon Web Services accounts in the organization, you
-    #   must choose `CUSTOMER_MANAGED`.
+    #   If you specify this as `CUSTOMER_MANAGED`, you must also specify a
+    #   `workspaceRoleArn` that the workspace will use for accessing Amazon
+    #   Web Services resources.
     #
-    #   For more information, see [Amazon Managed Grafana permissions and
-    #   policies for Amazon Web Services data sources and notification
-    #   channels][1]
+    #   For more information on the role and permissions needed, see [Amazon
+    #   Managed Grafana permissions and policies for Amazon Web Services data
+    #   sources and notification channels][1]
+    #
+    #   <note markdown="1"> Do not use this to convert a `CUSTOMER_MANAGED` workspace to
+    #   `SERVICE_MANAGED`. Do not include this parameter if you want to leave
+    #   the workspace as `SERVICE_MANAGED`.
+    #
+    #    You can convert a `CUSTOMER_MANAGED` workspace to `SERVICE_MANAGED`
+    #   using the Amazon Managed Grafana console. For more information, see
+    #   [Managing permissions for data sources and notification channels][2].
+    #
+    #    </note>
     #
     #
     #
     #   [1]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-manage-permissions.html
+    #   [2]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-datasource-and-notification.html
     #
     # @option params [Boolean] :remove_network_access_configuration
     #   Whether to remove the network access configuration from the workspace.
@@ -1373,15 +1380,7 @@ module Aws::ManagedGrafana
     #   sources for your Grafana workspace to connect to.
     #
     # @option params [Array<String>] :workspace_data_sources
-    #   Specify the Amazon Web Services data sources that you want to be
-    #   queried in this workspace. Specifying these data sources here enables
-    #   Amazon Managed Grafana to create IAM roles and permissions that allow
-    #   Amazon Managed Grafana to read data from these sources. You must still
-    #   add them as data sources in the Grafana console in the workspace.
-    #
-    #   If you don't specify a data source here, you can still add it as a
-    #   data source later in the workspace console. However, you will then
-    #   have to manually configure permissions for it.
+    #   This parameter is for internal use only, and should not be used.
     #
     # @option params [String] :workspace_description
     #   A description for the workspace. This is used only to help you
@@ -1405,12 +1404,10 @@ module Aws::ManagedGrafana
     #   of an organization.
     #
     # @option params [String] :workspace_role_arn
-    #   The workspace needs an IAM role that grants permissions to the Amazon
-    #   Web Services resources that the workspace will view data from. If you
-    #   already have a role that you want to use, specify it here. If you omit
-    #   this field and you specify some Amazon Web Services resources in
-    #   `workspaceDataSources` or `workspaceNotificationDestinations`, a new
-    #   IAM role with the necessary permissions is automatically created.
+    #   Specifies an IAM role that grants permissions to Amazon Web Services
+    #   resources that the workspace accesses, such as data sources and
+    #   notification channels. If this workspace has `permissionType`
+    #   `CUSTOMER_MANAGED`, then this role is required.
     #
     # @return [Types::UpdateWorkspaceResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -1496,6 +1493,11 @@ module Aws::ManagedGrafana
     # groups in the assertion attribute are to have the `Admin` and `Editor`
     # roles in the workspace.
     #
+    # <note markdown="1"> Changes to the authentication method for a workspace may take a few
+    # minutes to take effect.
+    #
+    #  </note>
+    #
     # @option params [required, Array<String>] :authentication_providers
     #   Specifies whether this workspace uses SAML 2.0, IAM Identity Center
     #   (successor to Single Sign-On), or both to authenticate users for using
@@ -1626,7 +1628,7 @@ module Aws::ManagedGrafana
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-managedgrafana'
-      context[:gem_version] = '1.12.0'
+      context[:gem_version] = '1.13.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-managedgrafana/types.rb

@@ -304,22 +304,23 @@ module Aws::ManagedGrafana
     #   @return [String]
     #
     # @!attribute [rw] permission_type
-    #   If you specify `SERVICE_MANAGED` on AWS Grafana console, Amazon
-    #   Managed Grafana automatically creates the IAM roles and provisions
-    #   the permissions that the workspace needs to use Amazon Web Services
-    #   data sources and notification channels. In the CLI mode, the
-    #   permissionType `SERVICE_MANAGED` will not create the IAM role for
-    #   you. The ability for the Amazon Managed Grafana to create the IAM
-    #   role on behalf of the user is supported only in the Amazon Managed
-    #   Grafana AWS console. Use only the `CUSTOMER_MANAGED` permission type
-    #   when creating a workspace in the CLI.
-    #
-    #   If you specify `CUSTOMER_MANAGED`, you will manage those roles and
-    #   permissions yourself. If you are creating this workspace in a member
-    #   account of an organization that is not a delegated administrator
-    #   account, and you want the workspace to access data sources in other
-    #   Amazon Web Services accounts in the organization, you must choose
-    #   `CUSTOMER_MANAGED`.
+    #   When creating a workspace through the Amazon Web Services API, CLI
+    #   or Amazon Web Services CloudFormation, you must manage IAM roles and
+    #   provision the permissions that the workspace needs to use Amazon Web
+    #   Services data sources and notification channels.
+    #
+    #   You must also specify a `workspaceRoleArn` for a role that you will
+    #   manage for the workspace to use when accessing those datasources and
+    #   notification channels.
+    #
+    #   The ability for Amazon Managed Grafana to create and update IAM
+    #   roles on behalf of the user is supported only in the Amazon Managed
+    #   Grafana console, where this value may be set to `SERVICE_MANAGED`.
+    #
+    #   <note markdown="1"> Use only the `CUSTOMER_MANAGED` permission type when creating a
+    #   workspace with the API, CLI or Amazon Web Services CloudFormation.
+    #
+    #    </note>
     #
     #   For more information, see [Amazon Managed Grafana permissions and
     #   policies for Amazon Web Services data sources and notification
@@ -345,16 +346,7 @@ module Aws::ManagedGrafana
     #   @return [Types::VpcConfiguration]
     #
     # @!attribute [rw] workspace_data_sources
-    #   Specify the Amazon Web Services data sources that you want to be
-    #   queried in this workspace. Specifying these data sources here
-    #   enables Amazon Managed Grafana to create IAM roles and permissions
-    #   that allow Amazon Managed Grafana to read data from these sources.
-    #   You must still add them as data sources in the Grafana console in
-    #   the workspace.
-    #
-    #   If you don't specify a data source here, you can still add it as a
-    #   data source in the workspace console later. However, you will then
-    #   have to manually configure permissions for it.
+    #   This parameter is for internal use only, and should not be used.
     #   @return [Array<String>]
     #
     # @!attribute [rw] workspace_description
@@ -382,10 +374,11 @@ module Aws::ManagedGrafana
     #   @return [Array<String>]
     #
     # @!attribute [rw] workspace_role_arn
-    #   The workspace needs an IAM role that grants permissions to the
-    #   Amazon Web Services resources that the workspace will view data
-    #   from. If you already have a role that you want to use, specify it
-    #   here. The permission type should be set to `CUSTOMER_MANAGED`.
+    #   Specified the IAM role that grants permissions to the Amazon Web
+    #   Services resources that the workspace will view data from, including
+    #   both data sources and notification channels. You are responsible for
+    #   managing the permissions for this role as new data sources or
+    #   notification channels are added.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/grafana-2020-08-18/CreateWorkspaceRequest AWS API Documentation
@@ -1252,29 +1245,43 @@ module Aws::ManagedGrafana
     #
     # @!attribute [rw] organization_role_name
     #   The name of an IAM role that already exists to use to access
-    #   resources through Organizations.
+    #   resources through Organizations. This can only be used with a
+    #   workspace that has the `permissionType` set to `CUSTOMER_MANAGED`.
     #   @return [String]
     #
     # @!attribute [rw] permission_type
-    #   If you specify `SERVICE_MANAGED`, Amazon Managed Grafana
-    #   automatically creates the IAM roles and provisions the permissions
-    #   that the workspace needs to use Amazon Web Services data sources and
-    #   notification channels.
-    #
-    #   If you specify `CUSTOMER_MANAGED`, you will manage those roles and
-    #   permissions yourself. If you are creating this workspace in a member
-    #   account of an organization and that account is not a delegated
-    #   administrator account, and you want the workspace to access data
-    #   sources in other Amazon Web Services accounts in the organization,
-    #   you must choose `CUSTOMER_MANAGED`.
+    #   Use this parameter if you want to change a workspace from
+    #   `SERVICE_MANAGED` to `CUSTOMER_MANAGED`. This allows you to manage
+    #   the permissions that the workspace uses to access datasources and
+    #   notification channels. If the workspace is in a member Amazon Web
+    #   Services account of an organization, and that account is not a
+    #   delegated administrator account, and you want the workspace to
+    #   access data sources in other Amazon Web Services accounts in the
+    #   organization, you must choose `CUSTOMER_MANAGED`.
+    #
+    #   If you specify this as `CUSTOMER_MANAGED`, you must also specify a
+    #   `workspaceRoleArn` that the workspace will use for accessing Amazon
+    #   Web Services resources.
+    #
+    #   For more information on the role and permissions needed, see [Amazon
+    #   Managed Grafana permissions and policies for Amazon Web Services
+    #   data sources and notification channels][1]
+    #
+    #   <note markdown="1"> Do not use this to convert a `CUSTOMER_MANAGED` workspace to
+    #   `SERVICE_MANAGED`. Do not include this parameter if you want to
+    #   leave the workspace as `SERVICE_MANAGED`.
+    #
+    #    You can convert a `CUSTOMER_MANAGED` workspace to `SERVICE_MANAGED`
+    #   using the Amazon Managed Grafana console. For more information, see
+    #   [Managing permissions for data sources and notification
+    #   channels][2].
     #
-    #   For more information, see [Amazon Managed Grafana permissions and
-    #   policies for Amazon Web Services data sources and notification
-    #   channels][1]
+    #    </note>
     #
     #
     #
     #   [1]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-manage-permissions.html
+    #   [2]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-datasource-and-notification.html
     #   @return [String]
     #
     # @!attribute [rw] remove_network_access_configuration
@@ -1307,16 +1314,7 @@ module Aws::ManagedGrafana
     #   @return [Types::VpcConfiguration]
     #
     # @!attribute [rw] workspace_data_sources
-    #   Specify the Amazon Web Services data sources that you want to be
-    #   queried in this workspace. Specifying these data sources here
-    #   enables Amazon Managed Grafana to create IAM roles and permissions
-    #   that allow Amazon Managed Grafana to read data from these sources.
-    #   You must still add them as data sources in the Grafana console in
-    #   the workspace.
-    #
-    #   If you don't specify a data source here, you can still add it as a
-    #   data source later in the workspace console. However, you will then
-    #   have to manually configure permissions for it.
+    #   This parameter is for internal use only, and should not be used.
     #   @return [Array<String>]
     #
     # @!attribute [rw] workspace_description
@@ -1346,13 +1344,10 @@ module Aws::ManagedGrafana
     #   @return [Array<String>]
     #
     # @!attribute [rw] workspace_role_arn
-    #   The workspace needs an IAM role that grants permissions to the
-    #   Amazon Web Services resources that the workspace will view data
-    #   from. If you already have a role that you want to use, specify it
-    #   here. If you omit this field and you specify some Amazon Web
-    #   Services resources in `workspaceDataSources` or
-    #   `workspaceNotificationDestinations`, a new IAM role with the
-    #   necessary permissions is automatically created.
+    #   Specifies an IAM role that grants permissions to Amazon Web Services
+    #   resources that the workspace accesses, such as data sources and
+    #   notification channels. If this workspace has `permissionType`
+    #   `CUSTOMER_MANAGED`, then this role is required.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/grafana-2020-08-18/UpdateWorkspaceRequest AWS API Documentation
@@ -1507,6 +1502,10 @@ module Aws::ManagedGrafana
     #   Specifies the Amazon Web Services data sources that have been
     #   configured to have IAM roles and permissions created to allow Amazon
     #   Managed Grafana to read data from these sources.
+    #
+    #   This list is only used when the workspace was created through the
+    #   Amazon Web Services console, and the `permissionType` is
+    #   `SERVICE_MANAGED`.
     #   @return [Array<String>]
     #
     # @!attribute [rw] description
@@ -1576,25 +1575,32 @@ module Aws::ManagedGrafana
     #   @return [Array<String>]
     #
     # @!attribute [rw] permission_type
-    #   If this is `SERVICE_MANAGED`, Amazon Managed Grafana automatically
-    #   creates the IAM roles and provisions the permissions that the
-    #   workspace needs to use Amazon Web Services data sources and
+    #   If this is `SERVICE_MANAGED`, and the workplace was created through
+    #   the Amazon Managed Grafana console, then Amazon Managed Grafana
+    #   automatically creates the IAM roles and provisions the permissions
+    #   that the workspace needs to use Amazon Web Services data sources and
     #   notification channels.
     #
-    #   If this is `CUSTOMER_MANAGED`, you manage those roles and
-    #   permissions yourself. If you are creating this workspace in a member
-    #   account of an organization and that account is not a delegated
-    #   administrator account, and you want the workspace to access data
-    #   sources in other Amazon Web Services accounts in the organization,
-    #   you must choose `CUSTOMER_MANAGED`.
+    #   If this is `CUSTOMER_MANAGED`, you must manage those roles and
+    #   permissions yourself.
     #
-    #   For more information, see [Amazon Managed Grafana permissions and
-    #   policies for Amazon Web Services data sources and notification
-    #   channels][1]
+    #   If you are working with a workspace in a member account of an
+    #   organization and that account is not a delegated administrator
+    #   account, and you want the workspace to access data sources in other
+    #   Amazon Web Services accounts in the organization, this parameter
+    #   must be set to `CUSTOMER_MANAGED`.
     #
+    #   For more information about converting between customer and service
+    #   managed, see [Managing permissions for data sources and notification
+    #   channels][1]. For more information about the roles and permissions
+    #   that must be managed for customer managed workspaces, see [Amazon
+    #   Managed Grafana permissions and policies for Amazon Web Services
+    #   data sources and notification channels][2]
     #
     #
-    #   [1]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-manage-permissions.html
+    #
+    #   [1]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-datasource-and-notification.html
+    #   [2]: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-manage-permissions.html
     #   @return [String]
     #
     # @!attribute [rw] stack_set_name

data/lib/aws-sdk-managedgrafana.rb

@@ -52,6 +52,6 @@ require_relative 'aws-sdk-managedgrafana/customizations'
 # @!group service
 module Aws::ManagedGrafana
 
-  GEM_VERSION = '1.12.0'
+  GEM_VERSION = '1.13.0'
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-managedgrafana
 version: !ruby/object:Gem::Version
-  version: 1.12.0
+  version: 1.13.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-02-16 00:00:00.000000000 Z
+date: 2023-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core