Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. accountaccess
  6. Entitlement
Viewing docs for AWS v7.46.0
published on Thursday, Sep 10, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.accountaccess.Entitlement

aws logo aws logo
Viewing docs for AWS v7.46.0
published on Thursday, Sep 10, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Manages an AWS Account Access Entitlement. An Entitlement grants an IAM Identity Center principal the ability to assume a specific IAM role in a target AWS account through an Account Access Application.

    Note: Entitlements are immutable. Changing applicationArn or entitlement triggers replacement.

    Note: The IAM role referenced by entitlement.principal_role.role_arn must have a trust policy that allows the Account Access service to assume it. The role’s assumeRolePolicy must grant sts:AssumeRole, sts:SetContext, and sts:TagSession to the account-access.amazonaws.com service principal. Without sts:TagSession, credential retrieval for the entitlement fails. See the Complete Example below.

    Example Usage

    User Principal

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.accountaccess.Entitlement("example", {
    entitlement: {
        principalRole: {
            principal: {
                identityCenter: {
                    userId: "11111111-2222-3333-4444-555555555555",
                },
            },
            roleArn: "arn:aws:iam::123456789012:role/Developer",
        },
    },
    applicationArn: exampleAwsAccountaccessApplication.arn,
});

    import pulumi
import pulumi_aws as aws

example = aws.accountaccess.Entitlement("example",
    entitlement={
        "principal_role": {
            "principal": {
                "identity_center": {
                    "user_id": "11111111-2222-3333-4444-555555555555",
                },
            },
            "role_arn": "arn:aws:iam::123456789012:role/Developer",
        },
    },
    application_arn=example_aws_accountaccess_application["arn"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/accountaccess"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := accountaccess.NewEntitlement(ctx, "example", &accountaccess.EntitlementArgs{
			Entitlement: &accountaccess.EntitlementEntitlementArgs{
				PrincipalRole: &accountaccess.EntitlementEntitlementPrincipalRoleArgs{
					Principal: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalArgs{
						IdentityCenter: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs{
							UserId: pulumi.String("11111111-2222-3333-4444-555555555555"),
						},
					},
					RoleArn: pulumi.String("arn:aws:iam::123456789012:role/Developer"),
				},
			},
			ApplicationArn: pulumi.Any(exampleAwsAccountaccessApplication.Arn),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.AccountAccess.Entitlement("example", new()
    {
        EntitlementDetails = new Aws.AccountAccess.Inputs.EntitlementEntitlementArgs
        {
            PrincipalRole = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRoleArgs
            {
                Principal = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalArgs
                {
                    IdentityCenter = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs
                    {
                        UserId = "11111111-2222-3333-4444-555555555555",
                    },
                },
                RoleArn = "arn:aws:iam::123456789012:role/Developer",
            },
        },
        ApplicationArn = exampleAwsAccountaccessApplication.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.accountaccess.Entitlement;
import com.pulumi.aws.accountaccess.EntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Entitlement("example", EntitlementArgs.builder()
            .entitlement(EntitlementEntitlementArgs.builder()
                .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                    .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                        .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                            .userId("11111111-2222-3333-4444-555555555555")
                            .build())
                        .build())
                    .roleArn("arn:aws:iam::123456789012:role/Developer")
                    .build())
                .build())
            .applicationArn(exampleAwsAccountaccessApplication.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:accountaccess:Entitlement
    properties:
      entitlement:
        principalRole:
          principal:
            identityCenter:
              userId: 11111111-2222-3333-4444-555555555555
          roleArn: arn:aws:iam::123456789012:role/Developer
      applicationArn: ${exampleAwsAccountaccessApplication.arn}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_accountaccess_entitlement" "example" {
  entitlement = {
    principal_role = {
      principal = {
        identity_center = {
          user_id = "11111111-2222-3333-4444-555555555555"
        }
      }
      role_arn = "arn:aws:iam::123456789012:role/Developer"
    }
  }
  application_arn = exampleAwsAccountaccessApplication.arn
}

    Group Principal

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.accountaccess.Entitlement("example", {
    entitlement: {
        principalRole: {
            principal: {
                identityCenter: {
                    groupId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                },
            },
            roleArn: "arn:aws:iam::123456789012:role/Engineering",
        },
    },
    applicationArn: exampleAwsAccountaccessApplication.arn,
});

    import pulumi
import pulumi_aws as aws

example = aws.accountaccess.Entitlement("example",
    entitlement={
        "principal_role": {
            "principal": {
                "identity_center": {
                    "group_id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                },
            },
            "role_arn": "arn:aws:iam::123456789012:role/Engineering",
        },
    },
    application_arn=example_aws_accountaccess_application["arn"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/accountaccess"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := accountaccess.NewEntitlement(ctx, "example", &accountaccess.EntitlementArgs{
			Entitlement: &accountaccess.EntitlementEntitlementArgs{
				PrincipalRole: &accountaccess.EntitlementEntitlementPrincipalRoleArgs{
					Principal: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalArgs{
						IdentityCenter: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs{
							GroupId: pulumi.String("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"),
						},
					},
					RoleArn: pulumi.String("arn:aws:iam::123456789012:role/Engineering"),
				},
			},
			ApplicationArn: pulumi.Any(exampleAwsAccountaccessApplication.Arn),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.AccountAccess.Entitlement("example", new()
    {
        EntitlementDetails = new Aws.AccountAccess.Inputs.EntitlementEntitlementArgs
        {
            PrincipalRole = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRoleArgs
            {
                Principal = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalArgs
                {
                    IdentityCenter = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs
                    {
                        GroupId = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
                    },
                },
                RoleArn = "arn:aws:iam::123456789012:role/Engineering",
            },
        },
        ApplicationArn = exampleAwsAccountaccessApplication.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.accountaccess.Entitlement;
import com.pulumi.aws.accountaccess.EntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Entitlement("example", EntitlementArgs.builder()
            .entitlement(EntitlementEntitlementArgs.builder()
                .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                    .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                        .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                            .groupId("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee")
                            .build())
                        .build())
                    .roleArn("arn:aws:iam::123456789012:role/Engineering")
                    .build())
                .build())
            .applicationArn(exampleAwsAccountaccessApplication.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:accountaccess:Entitlement
    properties:
      entitlement:
        principalRole:
          principal:
            identityCenter:
              groupId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
          roleArn: arn:aws:iam::123456789012:role/Engineering
      applicationArn: ${exampleAwsAccountaccessApplication.arn}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_accountaccess_entitlement" "example" {
  entitlement = {
    principal_role = {
      principal = {
        identity_center = {
          group_id = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
        }
      }
      role_arn = "arn:aws:iam::123456789012:role/Engineering"
    }
  }
  application_arn = exampleAwsAccountaccessApplication.arn
}

    Complete Example

    The target IAM role must trust the Account Access service. This example provisions a role with the required trust policy and grants an entitlement to it.

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = aws.ssoadmin.getInstances({});
const exampleApplication = new aws.accountaccess.Application("example", {identitySource: {
    identityCenter: {
        instanceArn: example.then(example => example.arns?.[0]),
    },
}});
// The target role must allow the Account Access service to assume it.
// sts:TagSession is required for credential retrieval to succeed.
const target = new aws.iam.Role("target", {
    name: "example-account-access-developer",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                Service: "account-access.amazonaws.com",
            },
            Action: [
                "sts:AssumeRole",
                "sts:SetContext",
                "sts:TagSession",
            ],
        }],
    }),
});
const exampleEntitlement = new aws.accountaccess.Entitlement("example", {
    entitlement: {
        principalRole: {
            principal: {
                identityCenter: {
                    userId: "11111111-2222-3333-4444-555555555555",
                },
            },
            roleArn: target.arn,
        },
    },
    applicationArn: exampleApplication.arn,
});

    import pulumi
import json
import pulumi_aws as aws

example = aws.ssoadmin.get_instances()
example_application = aws.accountaccess.Application("example", identity_source={
    "identity_center": {
        "instance_arn": example.arns[0],
    },
})
# The target role must allow the Account Access service to assume it.
# sts:TagSession is required for credential retrieval to succeed.
target = aws.iam.Role("target",
    name="example-account-access-developer",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Principal": {
                "Service": "account-access.amazonaws.com",
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetContext",
                "sts:TagSession",
            ],
        }],
    }))
example_entitlement = aws.accountaccess.Entitlement("example",
    entitlement={
        "principal_role": {
            "principal": {
                "identity_center": {
                    "user_id": "11111111-2222-3333-4444-555555555555",
                },
            },
            "role_arn": target.arn,
        },
    },
    application_arn=example_application.arn)

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/accountaccess"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ssoadmin"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := ssoadmin.GetInstances(ctx, &ssoadmin.GetInstancesArgs{}, nil)
		if err != nil {
			return err
		}
		exampleApplication, err := accountaccess.NewApplication(ctx, "example", &accountaccess.ApplicationArgs{
			IdentitySource: &accountaccess.ApplicationIdentitySourceArgs{
				IdentityCenter: &accountaccess.ApplicationIdentitySourceIdentityCenterArgs{
					InstanceArn: pulumi.String(example.Arns[0]),
				},
			},
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"Version": "2012-10-17",
			"Statement": []map[string]interface{}{
				map[string]interface{}{
					"Effect": "Allow",
					"Principal": map[string]string{
						"Service": "account-access.amazonaws.com",
					},
					"Action": []string{
						"sts:AssumeRole",
						"sts:SetContext",
						"sts:TagSession",
					},
				},
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		// The target role must allow the Account Access service to assume it.
		// sts:TagSession is required for credential retrieval to succeed.
		target, err := iam.NewRole(ctx, "target", &iam.RoleArgs{
			Name:             pulumi.String("example-account-access-developer"),
			AssumeRolePolicy: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		_, err = accountaccess.NewEntitlement(ctx, "example", &accountaccess.EntitlementArgs{
			Entitlement: &accountaccess.EntitlementEntitlementArgs{
				PrincipalRole: &accountaccess.EntitlementEntitlementPrincipalRoleArgs{
					Principal: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalArgs{
						IdentityCenter: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs{
							UserId: pulumi.String("11111111-2222-3333-4444-555555555555"),
						},
					},
					RoleArn: target.Arn,
				},
			},
			ApplicationArn: exampleApplication.Arn,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = Aws.SsoAdmin.GetInstances.Invoke();

    var exampleApplication = new Aws.AccountAccess.Application("example", new()
    {
        IdentitySource = new Aws.AccountAccess.Inputs.ApplicationIdentitySourceArgs
        {
            IdentityCenter = new Aws.AccountAccess.Inputs.ApplicationIdentitySourceIdentityCenterArgs
            {
                InstanceArn = example.Apply(getInstancesResult => getInstancesResult.Arns[0]),
            },
        },
    });

    // The target role must allow the Account Access service to assume it.
    // sts:TagSession is required for credential retrieval to succeed.
    var target = new Aws.Iam.Role("target", new()
    {
        Name = "example-account-access-developer",
        AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Effect"] = "Allow",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["Service"] = "account-access.amazonaws.com",
                    },
                    ["Action"] = new[]
                    {
                        "sts:AssumeRole",
                        "sts:SetContext",
                        "sts:TagSession",
                    },
                },
            },
        }),
    });

    var exampleEntitlement = new Aws.AccountAccess.Entitlement("example", new()
    {
        EntitlementDetails = new Aws.AccountAccess.Inputs.EntitlementEntitlementArgs
        {
            PrincipalRole = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRoleArgs
            {
                Principal = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalArgs
                {
                    IdentityCenter = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs
                    {
                        UserId = "11111111-2222-3333-4444-555555555555",
                    },
                },
                RoleArn = target.Arn,
            },
        },
        ApplicationArn = exampleApplication.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ssoadmin.SsoadminFunctions;
import com.pulumi.aws.ssoadmin.inputs.GetInstancesArgs;
import com.pulumi.aws.accountaccess.Application;
import com.pulumi.aws.accountaccess.ApplicationArgs;
import com.pulumi.aws.accountaccess.inputs.ApplicationIdentitySourceArgs;
import com.pulumi.aws.accountaccess.inputs.ApplicationIdentitySourceIdentityCenterArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.accountaccess.Entitlement;
import com.pulumi.aws.accountaccess.EntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRoleArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalArgs;
import com.pulumi.aws.accountaccess.inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = SsoadminFunctions.getInstances(GetInstancesArgs.builder()
            .build());

        var exampleApplication = new Application("exampleApplication", ApplicationArgs.builder()
            .identitySource(ApplicationIdentitySourceArgs.builder()
                .identityCenter(ApplicationIdentitySourceIdentityCenterArgs.builder()
                    .instanceArn(example.arns()[0])
                    .build())
                .build())
            .build());

        // The target role must allow the Account Access service to assume it.
        // sts:TagSession is required for credential retrieval to succeed.
        var target = new Role("target", RoleArgs.builder()
            .name("example-account-access-developer")
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "account-access.amazonaws.com")
                        )),
                        jsonProperty("Action", jsonArray(
                            "sts:AssumeRole", 
                            "sts:SetContext", 
                            "sts:TagSession"
                        ))
                    )))
                )))
            .build());

        var exampleEntitlement = new Entitlement("exampleEntitlement", EntitlementArgs.builder()
            .entitlement(EntitlementEntitlementArgs.builder()
                .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
                    .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                        .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                            .userId("11111111-2222-3333-4444-555555555555")
                            .build())
                        .build())
                    .roleArn(target.arn())
                    .build())
                .build())
            .applicationArn(exampleApplication.arn())
            .build());

    }
}

    resources:
  exampleApplication:
    type: aws:accountaccess:Application
    name: example
    properties:
      identitySource:
        identityCenter:
          instanceArn: ${example.arns[0]}
  # The target role must allow the Account Access service to assume it.
  # sts:TagSession is required for credential retrieval to succeed.
  target:
    type: aws:iam:Role
    properties:
      name: example-account-access-developer
      assumeRolePolicy:
        fn::toJSON:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service: account-access.amazonaws.com
              Action:
                - sts:AssumeRole
                - sts:SetContext
                - sts:TagSession
  exampleEntitlement:
    type: aws:accountaccess:Entitlement
    name: example
    properties:
      entitlement:
        principalRole:
          principal:
            identityCenter:
              userId: 11111111-2222-3333-4444-555555555555
          roleArn: ${target.arn}
      applicationArn: ${exampleApplication.arn}
variables:
  example:
    fn::invoke:
      function: aws:ssoadmin:getInstances
      arguments: {}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_ssoadmin_getinstances" "example" {
}

resource "aws_accountaccess_application" "example" {
  identity_source = {
    identity_center = {
      instance_arn = data.aws_ssoadmin_getinstances.example.arns[0]
    }
  }
}
# The target role must allow the Account Access service to assume it.
# sts:TagSession is required for credential retrieval to succeed.
resource "aws_iam_role" "target" {
  name = "example-account-access-developer"
  assume_role_policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Effect" = "Allow"
      "Principal" = {
        "Service" = "account-access.amazonaws.com"
      }
      "Action" = ["sts:AssumeRole", "sts:SetContext", "sts:TagSession"]
    }]
  })
}
resource "aws_accountaccess_entitlement" "example" {
  entitlement = {
    principal_role = {
      principal = {
        identity_center = {
          user_id = "11111111-2222-3333-4444-555555555555"
        }
      }
      role_arn = aws_iam_role.target.arn
    }
  }
  application_arn = aws_accountaccess_application.example.arn
}

    Create Entitlement Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Entitlement(name: string, args: EntitlementArgs, opts?: CustomResourceOptions);
    @overload
def Entitlement(resource_name: str,
                args: EntitlementArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def Entitlement(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                application_arn: Optional[str] = None,
                entitlement: Optional[EntitlementEntitlementArgs] = None,
                region: Optional[str] = None)
    func NewEntitlement(ctx *Context, name string, args EntitlementArgs, opts ...ResourceOption) (*Entitlement, error)
    public Entitlement(string name, EntitlementArgs args, CustomResourceOptions? opts = null)
    public Entitlement(String name, EntitlementArgs args)
public Entitlement(String name, EntitlementArgs args, CustomResourceOptions options)

    type: aws:accountaccess:Entitlement
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_accountaccess_entitlement" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args EntitlementArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args EntitlementArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args EntitlementArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args EntitlementArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args EntitlementArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var entitlementResource = new Aws.AccountAccess.Entitlement("entitlementResource", new()
{
    ApplicationArn = "string",
    EntitlementDetails = new Aws.AccountAccess.Inputs.EntitlementEntitlementArgs
    {
        PrincipalRole = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRoleArgs
        {
            Principal = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalArgs
            {
                IdentityCenter = new Aws.AccountAccess.Inputs.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs
                {
                    GroupId = "string",
                    UserId = "string",
                },
            },
            RoleArn = "string",
            AccountId = "string",
            AccountName = "string",
        },
    },
    Region = "string",
});

    example, err := accountaccess.NewEntitlement(ctx, "entitlementResource", &accountaccess.EntitlementArgs{
	ApplicationArn: pulumi.String("string"),
	Entitlement: &accountaccess.EntitlementEntitlementArgs{
		PrincipalRole: &accountaccess.EntitlementEntitlementPrincipalRoleArgs{
			Principal: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalArgs{
				IdentityCenter: &accountaccess.EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs{
					GroupId: pulumi.String("string"),
					UserId:  pulumi.String("string"),
				},
			},
			RoleArn:     pulumi.String("string"),
			AccountId:   pulumi.String("string"),
			AccountName: pulumi.String("string"),
		},
	},
	Region: pulumi.String("string"),
})

    resource "aws_accountaccess_entitlement" "entitlementResource" {
  lifecycle {
    create_before_destroy = true
  }
  application_arn = "string"
  entitlement = {
    principal_role = {
      principal = {
        identity_center = {
          group_id = "string"
          user_id  = "string"
        }
      }
      role_arn     = "string"
      account_id   = "string"
      account_name = "string"
    }
  }
  region = "string"
}

    var entitlementResource = new Entitlement("entitlementResource", EntitlementArgs.builder()
    .applicationArn("string")
    .entitlement(EntitlementEntitlementArgs.builder()
        .principalRole(EntitlementEntitlementPrincipalRoleArgs.builder()
            .principal(EntitlementEntitlementPrincipalRolePrincipalArgs.builder()
                .identityCenter(EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs.builder()
                    .groupId("string")
                    .userId("string")
                    .build())
                .build())
            .roleArn("string")
            .accountId("string")
            .accountName("string")
            .build())
        .build())
    .region("string")
    .build());

    entitlement_resource = aws.accountaccess.Entitlement("entitlementResource",
    application_arn="string",
    entitlement={
        "principal_role": {
            "principal": {
                "identity_center": {
                    "group_id": "string",
                    "user_id": "string",
                },
            },
            "role_arn": "string",
            "account_id": "string",
            "account_name": "string",
        },
    },
    region="string")

    const entitlementResource = new aws.accountaccess.Entitlement("entitlementResource", {
    applicationArn: "string",
    entitlement: {
        principalRole: {
            principal: {
                identityCenter: {
                    groupId: "string",
                    userId: "string",
                },
            },
            roleArn: "string",
            accountId: "string",
            accountName: "string",
        },
    },
    region: "string",
});

    type: aws:accountaccess:Entitlement
properties:
    applicationArn: string
    entitlement:
        principalRole:
            accountId: string
            accountName: string
            principal:
                identityCenter:
                    groupId: string
                    userId: string
            roleArn: string
    region: string

    Entitlement Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Entitlement resource accepts the following input properties:

    ApplicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    EntitlementDetails EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    ApplicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    Entitlement EntitlementEntitlementArgs

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    application_arn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement object

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn String
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    application_arn str
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlementArgs

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn String
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement Property Map

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Entitlement resource produces the following output properties:

    EntitlementId string
    Service-assigned unique identifier for this Entitlement.
    Id string
    The provider-assigned unique ID for this managed resource.
    EntitlementId string
    Service-assigned unique identifier for this Entitlement.
    Id string
    The provider-assigned unique ID for this managed resource.
    entitlement_id string
    Service-assigned unique identifier for this Entitlement.
    id string
    The provider-assigned unique ID for this managed resource.
    entitlementId String
    Service-assigned unique identifier for this Entitlement.
    id String
    The provider-assigned unique ID for this managed resource.
    entitlementId string
    Service-assigned unique identifier for this Entitlement.
    id string
    The provider-assigned unique ID for this managed resource.
    entitlement_id str
    Service-assigned unique identifier for this Entitlement.
    id str
    The provider-assigned unique ID for this managed resource.
    entitlementId String
    Service-assigned unique identifier for this Entitlement.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing Entitlement Resource

    Get an existing Entitlement resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: EntitlementState, opts?: CustomResourceOptions): Entitlement
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_arn: Optional[str] = None,
        entitlement: Optional[EntitlementEntitlementArgs] = None,
        entitlement_id: Optional[str] = None,
        region: Optional[str] = None) -> Entitlement
    func GetEntitlement(ctx *Context, name string, id IDInput, state *EntitlementState, opts ...ResourceOption) (*Entitlement, error)
    public static Entitlement Get(string name, Input<string> id, EntitlementState? state, CustomResourceOptions? opts = null)
    public static Entitlement get(String name, Output<String> id, EntitlementState state, CustomResourceOptions options)
    resources:  _:    type: aws:accountaccess:Entitlement    get:      id: ${id}
    import {
  to = aws_accountaccess_entitlement.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApplicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    EntitlementDetails EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    EntitlementId string
    Service-assigned unique identifier for this Entitlement.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    ApplicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    Entitlement EntitlementEntitlementArgs

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    EntitlementId string
    Service-assigned unique identifier for this Entitlement.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    application_arn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement object

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    entitlement_id string
    Service-assigned unique identifier for this Entitlement.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn String
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    entitlementId String
    Service-assigned unique identifier for this Entitlement.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn string
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlement

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    entitlementId string
    Service-assigned unique identifier for this Entitlement.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    application_arn str
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement EntitlementEntitlementArgs

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    entitlement_id str
    Service-assigned unique identifier for this Entitlement.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    applicationArn String
    ARN of the parent Account Access Application. Forces replacement when changed.
    entitlement Property Map

    Entitlement configuration. See entitlement Block below.

    The following arguments are optional:

    entitlementId String
    Service-assigned unique identifier for this Entitlement.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    Supporting Types

    EntitlementEntitlement, EntitlementEntitlementArgs

    PrincipalRole EntitlementEntitlementPrincipalRole
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    PrincipalRole EntitlementEntitlementPrincipalRole
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    principal_role object
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    principalRole EntitlementEntitlementPrincipalRole
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    principalRole EntitlementEntitlementPrincipalRole
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    principal_role EntitlementEntitlementPrincipalRole
    Principal role entitlement configuration. See entitlement.principal_role Block below.
    principalRole Property Map
    Principal role entitlement configuration. See entitlement.principal_role Block below.

    EntitlementEntitlementPrincipalRole, EntitlementEntitlementPrincipalRoleArgs

    Principal EntitlementEntitlementPrincipalRolePrincipal
    Principal configuration. See entitlement.principal_role.principal Block below.
    RoleArn string
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    AccountId string
    Target AWS account ID.
    AccountName string
    Target AWS account name.
    Principal EntitlementEntitlementPrincipalRolePrincipal
    Principal configuration. See entitlement.principal_role.principal Block below.
    RoleArn string
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    AccountId string
    Target AWS account ID.
    AccountName string
    Target AWS account name.
    principal object
    Principal configuration. See entitlement.principal_role.principal Block below.
    role_arn string
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    account_id string
    Target AWS account ID.
    account_name string
    Target AWS account name.
    principal EntitlementEntitlementPrincipalRolePrincipal
    Principal configuration. See entitlement.principal_role.principal Block below.
    roleArn String
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    accountId String
    Target AWS account ID.
    accountName String
    Target AWS account name.
    principal EntitlementEntitlementPrincipalRolePrincipal
    Principal configuration. See entitlement.principal_role.principal Block below.
    roleArn string
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    accountId string
    Target AWS account ID.
    accountName string
    Target AWS account name.
    principal EntitlementEntitlementPrincipalRolePrincipal
    Principal configuration. See entitlement.principal_role.principal Block below.
    role_arn str
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    account_id str
    Target AWS account ID.
    account_name str
    Target AWS account name.
    principal Property Map
    Principal configuration. See entitlement.principal_role.principal Block below.
    roleArn String
    ARN of the IAM role in the target AWS account that the principal is granted access to.
    accountId String
    Target AWS account ID.
    accountName String
    Target AWS account name.

    EntitlementEntitlementPrincipalRolePrincipal, EntitlementEntitlementPrincipalRolePrincipalArgs

    IdentityCenter EntitlementEntitlementPrincipalRolePrincipalIdentityCenter
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    IdentityCenter EntitlementEntitlementPrincipalRolePrincipalIdentityCenter
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    identity_center object
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    identityCenter EntitlementEntitlementPrincipalRolePrincipalIdentityCenter
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    identityCenter EntitlementEntitlementPrincipalRolePrincipalIdentityCenter
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    identity_center EntitlementEntitlementPrincipalRolePrincipalIdentityCenter
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.
    identityCenter Property Map
    IAM Identity Center principal configuration. See entitlement.principal_role.principal.identity_center Block below.

    EntitlementEntitlementPrincipalRolePrincipalIdentityCenter, EntitlementEntitlementPrincipalRolePrincipalIdentityCenterArgs

    GroupId string
    IAM Identity Center group ID.
    UserId string
    IAM Identity Center user ID.
    GroupId string
    IAM Identity Center group ID.
    UserId string
    IAM Identity Center user ID.
    group_id string
    IAM Identity Center group ID.
    user_id string
    IAM Identity Center user ID.
    groupId String
    IAM Identity Center group ID.
    userId String
    IAM Identity Center user ID.
    groupId string
    IAM Identity Center group ID.
    userId string
    IAM Identity Center user ID.
    group_id str
    IAM Identity Center group ID.
    user_id str
    IAM Identity Center user ID.
    groupId String
    IAM Identity Center group ID.
    userId String
    IAM Identity Center user ID.

    Import

    Identity Schema

    Required

    • applicationArn (String) ARN of the parent Account Access Application.
    • entitlementId (String) Service-assigned unique identifier for this Entitlement.

    Optional

    • accountId (String) AWS Account where this resource is managed.
    • region (String) Region where this resource is managed.

    Using pulumi import, import Account Access Entitlements using the composite ID. For example:

    $ pulumi import aws:accountaccess/entitlement:Entitlement example arn:aws:account-access:us-east-1:123456789012:application/aam-0123456789abcdef,ent-0123456789abcdef

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.46.0
    published on Thursday, Sep 10, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial