JA EN
shiichan

Identity Store APIs Now Accept ARNs Directly, No More Stripping to IDs!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hi, it's Shii-chan!

AWS What's New aws.amazon.com

This one makes your code a little simpler!

What was announced?

According to AWS What's New, AWS IAM Identity Center's Identity Store APIs now accept the Amazon Resource Name (ARN) for a user, group, group membership, or identity store anywhere the APIs previously accepted the resource ID.

ARN support is additive, and existing integrations continue to work unchanged.

The story so far

You may already hold resource ARNs, for example from IAM policy evaluation, CloudTrail events, or cross-service integrations. Before, you had to strip the ARN down to the resource ID before calling Identity Store APIs.

What changes

  • You can pass either an ARN or an ID directly
  • Application code gets simpler
  • Fewer chances for parsing errors

Dive Deep

  • The change applies to every request identifier field across the Identity Store API surface
  • Responses continue to return resource IDs as before
  • Malformed or wrong-resource-type ARNs return a ValidationException
  • Available in all AWS Regions where IAM Identity Center is offered, at no additional cost

See the Identity Store API Reference for details.

Wrap-up

  • Identity Store APIs accept ARNs
  • Existing calls with IDs keep working
  • Responses still return IDs, and invalid ARNs return a ValidationException

This is for developers building integrations on the Identity Store APIs!

Related posts