@pulumi/aws 7.45.0 → 7.46.0-alpha.1789046493

package/accountaccess/application.d.ts

@@ -2,9 +2,11 @@ import * as pulumi from "@pulumi/pulumi";
 import * as inputs from "../types/input";
 import * as outputs from "../types/output";
 /**
- * Manages an AWS Account Access Application bound to an IAM Identity Center instance.
+ * Manages an AWS Account Access Application. An Application binds Account Access to an IAM Identity Center instance and serves as the parent container for entitlements that grant principals access to roles in target accounts.
  *
- * > **NOTE:** AWS Account Access allows only one Application per Identity Center instance. Attempting to create a second Application for the same instance will fail. Use `pulumi import` to bring an existing Application under management.
+ * > **Note:** Only one Application may exist per IAM Identity Center instance. Attempting to create a second Application for the same instance produces an error directing you to import the existing resource.
+ *
+ * > **Note:** Granting access to roles in target accounts is done with `aws.accountaccess.Entitlement`. Each target role must trust the Account Access service in its `assumeRolePolicy` — see that resource's documentation for the required trust policy.
  *
  * ## Example Usage
  *

package/accountaccess/application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../accountaccess/application.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,qBAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,WAAW;IAOxI;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW;IAOtD;;OAEG;IACH,SAAgC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D;;;;OAIG;IACH,SAAwB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACvG;;OAEG;IACH,SAAwB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACjF;;OAEG;IACH,SAAgC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAC,CAAC,CAAC;IAChF;;OAEG;IACH,SAAgC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE,SAAwB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAEvG;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA6BvF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAC1F;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACvE;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IAC1E;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;IAC7E;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjF"}
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../accountaccess/application.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,qBAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,WAAW;IAOxI;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW;IAOtD;;OAEG;IACH,SAAgC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D;;;;OAIG;IACH,SAAwB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACvG;;OAEG;IACH,SAAwB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACjF;;OAEG;IACH,SAAgC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAC,CAAC,CAAC;IAChF;;OAEG;IACH,SAAgC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE,SAAwB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAEvG;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA6BvF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAC1F;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACvE;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IAC1E;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;IAC7E;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjF"}

package/accountaccess/application.js

@@ -29,9 +29,11 @@ exports.Application = void 0;
 const pulumi = __importStar(require("@pulumi/pulumi"));
 const utilities = __importStar(require("../utilities"));
 /**
- * Manages an AWS Account Access Application bound to an IAM Identity Center instance.
+ * Manages an AWS Account Access Application. An Application binds Account Access to an IAM Identity Center instance and serves as the parent container for entitlements that grant principals access to roles in target accounts.
  *
- * > **NOTE:** AWS Account Access allows only one Application per Identity Center instance. Attempting to create a second Application for the same instance will fail. Use `pulumi import` to bring an existing Application under management.
+ * > **Note:** Only one Application may exist per IAM Identity Center instance. Attempting to create a second Application for the same instance produces an error directing you to import the existing resource.
+ *
+ * > **Note:** Granting access to roles in target accounts is done with `aws.accountaccess.Entitlement`. Each target role must trust the Account Access service in its `assumeRolePolicy` — see that resource's documentation for the required trust policy.
  *
  * ## Example Usage
  *

package/accountaccess/application.js.map

@@ -1 +1 @@
-{"version":3,"file":"application.js","sourceRoot":"","sources":["../../accountaccess/application.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAIzC,wDAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAwB,EAAE,IAAmC;QACtH,OAAO,IAAI,WAAW,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,2CAA2C,CAAC;IAElF;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IAsCD,YAAY,IAAY,EAAE,WAAgD,EAAE,IAAmC;QAC3G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA2C,CAAC;YAC1D,cAAc,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC;YACnC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,EAAE,cAAc,CAAC;YACzD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC;YACzC,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC;YACrC,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC;YAC3C,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;YAC7C,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;SAChD;aAAM;YACH,MAAM,IAAI,GAAG,WAA0C,CAAC;YACxD,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aACjE;YACD,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,cAAc,CAAC;YACxD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAClD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA3FL,kCA4FC"}
+{"version":3,"file":"application.js","sourceRoot":"","sources":["../../accountaccess/application.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAIzC,wDAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAwB,EAAE,IAAmC;QACtH,OAAO,IAAI,WAAW,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,2CAA2C,CAAC;IAElF;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IAsCD,YAAY,IAAY,EAAE,WAAgD,EAAE,IAAmC;QAC3G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA2C,CAAC;YAC1D,cAAc,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC;YACnC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,EAAE,cAAc,CAAC;YACzD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC;YACzC,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC;YACrC,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC;YAC3C,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;YAC7C,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;SAChD;aAAM;YACH,MAAM,IAAI,GAAG,WAA0C,CAAC;YACxD,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aACjE;YACD,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,cAAc,CAAC;YACxD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC1C,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAClD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA3FL,kCA4FC"}

package/accountaccess/entitlement.d.ts

@@ -0,0 +1,208 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+/**
+ * Manages an AWS Account Access Entitlement. An Entitlement grants an IAM Identity Center principal the ability to assume a specific IAM role in a target AWS account through an Account Access Application.
+ *
+ * > **Note:** Entitlements are immutable. Changing `applicationArn` or `entitlement` triggers replacement.
+ *
+ * > **Note:** The IAM role referenced by `entitlement.principal_role.role_arn` must have a trust policy that allows the Account Access service to assume it. The role's `assumeRolePolicy` must grant `sts:AssumeRole`, `sts:SetContext`, and `sts:TagSession` to the `account-access.amazonaws.com` service principal. Without `sts:TagSession`, credential retrieval for the entitlement fails. See the Complete Example below.
+ *
+ * ## Example Usage
+ *
+ * ### User Principal
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     userId: "11111111-2222-3333-4444-555555555555",
+ *                 },
+ *             },
+ *             roleArn: "arn:aws:iam::123456789012:role/Developer",
+ *         },
+ *     },
+ *     applicationArn: exampleAwsAccountaccessApplication.arn,
+ * });
+ * ```
+ *
+ * ### Group Principal
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     groupId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+ *                 },
+ *             },
+ *             roleArn: "arn:aws:iam::123456789012:role/Engineering",
+ *         },
+ *     },
+ *     applicationArn: exampleAwsAccountaccessApplication.arn,
+ * });
+ * ```
+ *
+ * ### Complete Example
+ *
+ * The target IAM role must trust the Account Access service. This example provisions a role with the required trust policy and grants an entitlement to it.
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.ssoadmin.getInstances({});
+ * const exampleApplication = new aws.accountaccess.Application("example", {identitySource: {
+ *     identityCenter: {
+ *         instanceArn: example.then(example => example.arns?.[0]),
+ *     },
+ * }});
+ * // The target role must allow the Account Access service to assume it.
+ * // sts:TagSession is required for credential retrieval to succeed.
+ * const target = new aws.iam.Role("target", {
+ *     name: "example-account-access-developer",
+ *     assumeRolePolicy: JSON.stringify({
+ *         Version: "2012-10-17",
+ *         Statement: [{
+ *             Effect: "Allow",
+ *             Principal: {
+ *                 Service: "account-access.amazonaws.com",
+ *             },
+ *             Action: [
+ *                 "sts:AssumeRole",
+ *                 "sts:SetContext",
+ *                 "sts:TagSession",
+ *             ],
+ *         }],
+ *     }),
+ * });
+ * const exampleEntitlement = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     userId: "11111111-2222-3333-4444-555555555555",
+ *                 },
+ *             },
+ *             roleArn: target.arn,
+ *         },
+ *     },
+ *     applicationArn: exampleApplication.arn,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * ### Identity Schema
+ *
+ * #### Required
+ *
+ * * `applicationArn` (String) ARN of the parent Account Access Application.
+ * * `entitlementId` (String) Service-assigned unique identifier for this Entitlement.
+ *
+ * #### Optional
+ *
+ * * `accountId` (String) AWS Account where this resource is managed.
+ * * `region` (String) Region where this resource is managed.
+ *
+ * Using `pulumi import`, import Account Access Entitlements using the composite ID. For example:
+ *
+ * ```sh
+ * $ pulumi import aws:accountaccess/entitlement:Entitlement example arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef,ent-0123456789abcdef
+ * ```
+ */
+export declare class Entitlement extends pulumi.CustomResource {
+    /**
+     * Get an existing Entitlement resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: EntitlementState, opts?: pulumi.CustomResourceOptions): Entitlement;
+    /**
+     * Returns true if the given object is an instance of Entitlement.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is Entitlement;
+    /**
+     * ARN of the parent Account Access Application. Forces replacement when changed.
+     */
+    readonly applicationArn: pulumi.Output<string>;
+    /**
+     * Entitlement configuration. See `entitlement` Block below.
+     *
+     * The following arguments are optional:
+     */
+    readonly entitlement: pulumi.Output<outputs.accountaccess.EntitlementEntitlement>;
+    /**
+     * Service-assigned unique identifier for this Entitlement.
+     */
+    readonly entitlementId: pulumi.Output<string>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    readonly region: pulumi.Output<string>;
+    /**
+     * Create a Entitlement resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: EntitlementArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering Entitlement resources.
+ */
+export interface EntitlementState {
+    /**
+     * ARN of the parent Account Access Application. Forces replacement when changed.
+     */
+    applicationArn?: pulumi.Input<string | undefined>;
+    /**
+     * Entitlement configuration. See `entitlement` Block below.
+     *
+     * The following arguments are optional:
+     */
+    entitlement?: pulumi.Input<inputs.accountaccess.EntitlementEntitlement | undefined>;
+    /**
+     * Service-assigned unique identifier for this Entitlement.
+     */
+    entitlementId?: pulumi.Input<string | undefined>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: pulumi.Input<string | undefined>;
+}
+/**
+ * The set of arguments for constructing a Entitlement resource.
+ */
+export interface EntitlementArgs {
+    /**
+     * ARN of the parent Account Access Application. Forces replacement when changed.
+     */
+    applicationArn: pulumi.Input<string>;
+    /**
+     * Entitlement configuration. See `entitlement` Block below.
+     *
+     * The following arguments are optional:
+     */
+    entitlement: pulumi.Input<inputs.accountaccess.EntitlementEntitlement>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: pulumi.Input<string | undefined>;
+}
+//# sourceMappingURL=entitlement.d.ts.map

package/accountaccess/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../accountaccess/entitlement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AACH,qBAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,WAAW;IAOxI;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW;IAOtD;;OAEG;IACH,SAAwB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D;;;;OAIG;IACH,SAAwB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACjG;;OAEG;IACH,SAAgC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE;;OAEG;IACH,SAAwB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtD;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA0BvF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACpF;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACvE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C"}

package/accountaccess/entitlement.js

@@ -0,0 +1,203 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Entitlement = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("../utilities"));
+/**
+ * Manages an AWS Account Access Entitlement. An Entitlement grants an IAM Identity Center principal the ability to assume a specific IAM role in a target AWS account through an Account Access Application.
+ *
+ * > **Note:** Entitlements are immutable. Changing `applicationArn` or `entitlement` triggers replacement.
+ *
+ * > **Note:** The IAM role referenced by `entitlement.principal_role.role_arn` must have a trust policy that allows the Account Access service to assume it. The role's `assumeRolePolicy` must grant `sts:AssumeRole`, `sts:SetContext`, and `sts:TagSession` to the `account-access.amazonaws.com` service principal. Without `sts:TagSession`, credential retrieval for the entitlement fails. See the Complete Example below.
+ *
+ * ## Example Usage
+ *
+ * ### User Principal
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     userId: "11111111-2222-3333-4444-555555555555",
+ *                 },
+ *             },
+ *             roleArn: "arn:aws:iam::123456789012:role/Developer",
+ *         },
+ *     },
+ *     applicationArn: exampleAwsAccountaccessApplication.arn,
+ * });
+ * ```
+ *
+ * ### Group Principal
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     groupId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+ *                 },
+ *             },
+ *             roleArn: "arn:aws:iam::123456789012:role/Engineering",
+ *         },
+ *     },
+ *     applicationArn: exampleAwsAccountaccessApplication.arn,
+ * });
+ * ```
+ *
+ * ### Complete Example
+ *
+ * The target IAM role must trust the Account Access service. This example provisions a role with the required trust policy and grants an entitlement to it.
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.ssoadmin.getInstances({});
+ * const exampleApplication = new aws.accountaccess.Application("example", {identitySource: {
+ *     identityCenter: {
+ *         instanceArn: example.then(example => example.arns?.[0]),
+ *     },
+ * }});
+ * // The target role must allow the Account Access service to assume it.
+ * // sts:TagSession is required for credential retrieval to succeed.
+ * const target = new aws.iam.Role("target", {
+ *     name: "example-account-access-developer",
+ *     assumeRolePolicy: JSON.stringify({
+ *         Version: "2012-10-17",
+ *         Statement: [{
+ *             Effect: "Allow",
+ *             Principal: {
+ *                 Service: "account-access.amazonaws.com",
+ *             },
+ *             Action: [
+ *                 "sts:AssumeRole",
+ *                 "sts:SetContext",
+ *                 "sts:TagSession",
+ *             ],
+ *         }],
+ *     }),
+ * });
+ * const exampleEntitlement = new aws.accountaccess.Entitlement("example", {
+ *     entitlement: {
+ *         principalRole: {
+ *             principal: {
+ *                 identityCenter: {
+ *                     userId: "11111111-2222-3333-4444-555555555555",
+ *                 },
+ *             },
+ *             roleArn: target.arn,
+ *         },
+ *     },
+ *     applicationArn: exampleApplication.arn,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * ### Identity Schema
+ *
+ * #### Required
+ *
+ * * `applicationArn` (String) ARN of the parent Account Access Application.
+ * * `entitlementId` (String) Service-assigned unique identifier for this Entitlement.
+ *
+ * #### Optional
+ *
+ * * `accountId` (String) AWS Account where this resource is managed.
+ * * `region` (String) Region where this resource is managed.
+ *
+ * Using `pulumi import`, import Account Access Entitlements using the composite ID. For example:
+ *
+ * ```sh
+ * $ pulumi import aws:accountaccess/entitlement:Entitlement example arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef,ent-0123456789abcdef
+ * ```
+ */
+class Entitlement extends pulumi.CustomResource {
+    /**
+     * Get an existing Entitlement resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new Entitlement(name, state, { ...opts, id: id });
+    }
+    /** @internal */
+    static __pulumiType = 'aws:accountaccess/entitlement:Entitlement';
+    /**
+     * Returns true if the given object is an instance of Entitlement.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === Entitlement.__pulumiType;
+    }
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["applicationArn"] = state?.applicationArn;
+            resourceInputs["entitlement"] = state?.entitlement;
+            resourceInputs["entitlementId"] = state?.entitlementId;
+            resourceInputs["region"] = state?.region;
+        }
+        else {
+            const args = argsOrState;
+            if (args?.applicationArn === undefined && !opts.urn) {
+                throw new Error("Missing required property 'applicationArn'");
+            }
+            if (args?.entitlement === undefined && !opts.urn) {
+                throw new Error("Missing required property 'entitlement'");
+            }
+            resourceInputs["applicationArn"] = args?.applicationArn;
+            resourceInputs["entitlement"] = args?.entitlement;
+            resourceInputs["region"] = args?.region;
+            resourceInputs["entitlementId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(Entitlement.__pulumiType, name, resourceInputs, opts);
+    }
+}
+exports.Entitlement = Entitlement;
+//# sourceMappingURL=entitlement.js.map

package/accountaccess/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../accountaccess/entitlement.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAIzC,wDAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAwB,EAAE,IAAmC;QACtH,OAAO,IAAI,WAAW,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,2CAA2C,CAAC;IAElF;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IA6BD,YAAY,IAAY,EAAE,WAAgD,EAAE,IAAmC;QAC3G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA2C,CAAC;YAC1D,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,EAAE,cAAc,CAAC;YACzD,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC;YACnD,cAAc,CAAC,eAAe,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;YACvD,cAAc,CAAC,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC;SAC5C;aAAM;YACH,MAAM,IAAI,GAAG,WAA0C,CAAC;YACxD,IAAI,IAAI,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aACjE;YACD,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;YACD,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,cAAc,CAAC;YACxD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;YACxC,cAAc,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACvD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA/EL,kCAgFC"}

package/accountaccess/getApplication.d.ts

@@ -0,0 +1,129 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as outputs from "../types/output";
+/**
+ * Looks up an existing AWS Account Access Application. Lookup is by Application ARN or by IAM Identity Center instance ARN (one Application per instance).
+ *
+ * ## Example Usage
+ *
+ * ### By Application ARN
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.accountaccess.getApplication({
+ *     arn: "arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef",
+ * });
+ * ```
+ *
+ * ### By Identity Center Instance
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.ssoadmin.getInstances({});
+ * const exampleGetApplication = example.then(example => aws.accountaccess.getApplication({
+ *     identityCenterInstanceArn: example.arns?.[0],
+ * }));
+ * ```
+ */
+export declare function getApplication(args?: GetApplicationArgs, opts?: pulumi.InvokeOptions): Promise<GetApplicationResult>;
+/**
+ * A collection of arguments for invoking getApplication.
+ */
+export interface GetApplicationArgs {
+    /**
+     * ARN of the Application to look up. Exactly one of `arn` or `identityCenterInstanceArn` must be specified.
+     */
+    arn?: string;
+    /**
+     * ARN of the IAM Identity Center instance whose bound Application should be returned. Exactly one of `arn` or `identityCenterInstanceArn` must be specified.
+     */
+    identityCenterInstanceArn?: string;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: string;
+}
+/**
+ * A collection of values returned by getApplication.
+ */
+export interface GetApplicationResult {
+    readonly arn: string;
+    /**
+     * Date and time, in [RFC3339 format](https://datatracker.ietf.org/doc/html/rfc3339), when the Application was created.
+     */
+    readonly createdAt: string;
+    readonly identityCenterInstanceArn?: string;
+    /**
+     * Identity source for the application. Forces replacement when changed. See `identitySource` Block below.
+     */
+    readonly identitySources: outputs.accountaccess.GetApplicationIdentitySource[];
+    readonly region: string;
+    /**
+     * Current lifecycle status. One of `CREATE_IN_PROGRESS`, `ACTIVE`, `DELETE_IN_PROGRESS`, `CREATE_FAILED`, `DELETE_FAILED`.
+     */
+    readonly status: string;
+    /**
+     * Map of tags assigned to the Application.
+     */
+    readonly tags: {
+        [key: string]: string;
+    };
+    /**
+     * Internal tenant identifier returned by the service.
+     */
+    readonly tenantId: string;
+    /**
+     * Date and time, in [RFC3339 format](https://datatracker.ietf.org/doc/html/rfc3339), when the Application was last updated.
+     */
+    readonly updatedAt: string;
+}
+/**
+ * Looks up an existing AWS Account Access Application. Lookup is by Application ARN or by IAM Identity Center instance ARN (one Application per instance).
+ *
+ * ## Example Usage
+ *
+ * ### By Application ARN
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.accountaccess.getApplication({
+ *     arn: "arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef",
+ * });
+ * ```
+ *
+ * ### By Identity Center Instance
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const example = aws.ssoadmin.getInstances({});
+ * const exampleGetApplication = example.then(example => aws.accountaccess.getApplication({
+ *     identityCenterInstanceArn: example.arns?.[0],
+ * }));
+ * ```
+ */
+export declare function getApplicationOutput(args?: GetApplicationOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetApplicationResult>;
+/**
+ * A collection of arguments for invoking getApplication.
+ */
+export interface GetApplicationOutputArgs {
+    /**
+     * ARN of the Application to look up. Exactly one of `arn` or `identityCenterInstanceArn` must be specified.
+     */
+    arn?: pulumi.Input<string | undefined>;
+    /**
+     * ARN of the IAM Identity Center instance whose bound Application should be returned. Exactly one of `arn` or `identityCenterInstanceArn` must be specified.
+     */
+    identityCenterInstanceArn?: pulumi.Input<string | undefined>;
+    /**
+     * Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
+     */
+    region?: pulumi.Input<string | undefined>;
+}
+//# sourceMappingURL=getApplication.d.ts.map

package/accountaccess/getApplication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getApplication.d.ts","sourceRoot":"","sources":["../../accountaccess/getApplication.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQpH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,4BAA4B,EAAE,CAAC;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAC,CAAC;IACvC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAQ5I;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACrC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvC;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C"}