{ "description": "ResourceShare is the Schema for the ResourceShares API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "ResourceShareSpec defines the desired state of ResourceShare.\n\nDescribes a resource share in RAM.", "properties": { "allowExternalPrincipals": { "description": "Specifies whether principals outside your organization in Organizations can\nbe associated with a resource share. A value of true lets you share with\nindividual Amazon Web Services accounts that are not in your organization.\nA value of false only has meaning if your account is a member of an Amazon\nWeb Services Organization. The default value is true.", "type": "boolean" }, "name": { "description": "Specifies the name of the resource share.", "type": "string" }, "permissionARNs": { "description": "Specifies the Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)\nof the RAM permission to associate with the resource share. If you do not\nspecify an ARN for the permission, RAM automatically attaches the default\nversion of the permission for each resource type. You can associate only\none permission with each resource type included in the resource share.", "items": { "type": "string" }, "type": "array" }, "permissionRefs": { "items": { "description": "AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference\ntype to provide more user friendly syntax for references using 'from' field\nEx:\nAPIIDRef:\n\n\tfrom:\n\t name: my-api", "properties": { "from": { "description": "AWSResourceReference provides all the values necessary to reference another\nk8s resource for finding the identifier(Id/ARN/Name)", "properties": { "name": { "type": "string" }, "namespace": { "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "type": "array" }, "principals": { "description": "Specifies a list of one or more principals to associate with the resource\nshare.\n\nYou can include the following values:\n\n - An Amazon Web Services account ID, for example: 123456789012\n\n - An Amazon Resource Name (ARN) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)\n of an organization in Organizations, for example: organizations::123456789012:organization/o-exampleorgid\n\n - An ARN of an organizational unit (OU) in Organizations, for example:\n organizations::123456789012:ou/o-exampleorgid/ou-examplerootid-exampleouid123\n\n - An ARN of an IAM role, for example: iam::123456789012:role/rolename\n\n - An ARN of an IAM user, for example: iam::123456789012user/username\n\nNot all resource types can be shared with IAM roles and users. For more information,\nsee Sharing with IAM roles and users (https://docs.aws.amazon.com/ram/latest/userguide/permissions.html#permissions-rbp-supported-resource-types)\nin the Resource Access Manager User Guide.", "items": { "type": "string" }, "type": "array" }, "resourceARNs": { "description": "Specifies a list of one or more ARNs of the resources to associate with the\nresource share.", "items": { "type": "string" }, "type": "array" }, "sources": { "description": "Specifies from which source accounts the service principal has access to\nthe resources in this resource share.", "items": { "type": "string" }, "type": "array" }, "tags": { "description": "A list of one or more tag key and value pairs. The tag key must be present\nand not be an empty string. The tag value must be present but can be an empty\nstring.", "items": { "description": "A structure containing a tag. A tag is metadata that you can attach to your\nresources to help organize and categorize them. You can also use them to\nhelp you secure your resources. For more information, see Controlling access\nto Amazon Web Services resources using tags (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html).\n\nFor more information about tags, see Tagging Amazon Web Services resources\n(https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the Amazon\nWeb Services General Reference Guide.", "properties": { "key": { "type": "string" }, "value": { "type": "string" } }, "type": "object", "additionalProperties": false }, "type": "array" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "status": { "description": "ResourceShareStatus defines the observed state of ResourceShare", "properties": { "ackResourceMetadata": { "description": "All CRs managed by ACK have a common `Status.ACKResourceMetadata` member\nthat is used to contain resource sync state, account ownership,\nconstructed ARN for the resource", "properties": { "arn": { "description": "ARN is the Amazon Resource Name for the resource. This is a\nglobally-unique identifier and is set only by the ACK service controller\nonce the controller has orchestrated the creation of the resource OR\nwhen it has verified that an \"adopted\" resource (a resource where the\nARN annotation was set by the Kubernetes user on the CR) exists and\nmatches the supplied CR's Spec field values.\nhttps://github.com/aws/aws-controllers-k8s/issues/270", "type": "string" }, "ownerAccountID": { "description": "OwnerAccountID is the AWS Account ID of the account that owns the\nbackend AWS service API resource.", "type": "string" }, "region": { "description": "Region is the AWS region in which the resource exists or will exist.", "type": "string" } }, "required": [ "ownerAccountID", "region" ], "type": "object", "additionalProperties": false }, "conditions": { "description": "All CRs managed by ACK have a common `Status.Conditions` member that\ncontains a collection of `ackv1alpha1.Condition` objects that describe\nthe various terminal states of the CR and its backend AWS service API\nresource", "items": { "description": "Condition is the common struct used by all CRDs managed by ACK service\ncontrollers to indicate terminal states of the CR and its backend AWS\nservice API resource", "properties": { "lastTransitionTime": { "description": "Last time the condition transitioned from one status to another.", "format": "date-time", "type": "string" }, "message": { "description": "A human readable message indicating details about the transition.", "type": "string" }, "reason": { "description": "The reason for the condition's last transition.", "type": "string" }, "status": { "description": "Status of the condition, one of True, False, Unknown.", "type": "string" }, "type": { "description": "Type is the type of the Condition", "type": "string" } }, "required": [ "status", "type" ], "type": "object", "additionalProperties": false }, "type": "array" }, "creationTime": { "description": "The date and time when the resource share was created.", "format": "date-time", "type": "string" }, "featureSet": { "description": "Indicates what features are available for this resource share. This parameter\ncan have one of the following values:\n\n * STANDARD \u2013 A resource share that supports all functionality. These\n resource shares are visible to all principals you share the resource share\n with. You can modify these resource shares in RAM using the console or\n APIs. This resource share might have been created by RAM, or it might\n have been CREATED_FROM_POLICY and then promoted.\n\n * CREATED_FROM_POLICY \u2013 The customer manually shared a resource by attaching\n a resource-based policy. That policy did not match any existing managed\n permissions, so RAM created this customer managed permission automatically\n on the customer's behalf based on the attached policy document. This type\n of resource share is visible only to the Amazon Web Services account that\n created it. You can't modify it in RAM unless you promote it. For more\n information, see PromoteResourceShareCreatedFromPolicy.\n\n * PROMOTING_TO_STANDARD \u2013 This resource share was originally CREATED_FROM_POLICY,\n but the customer ran the PromoteResourceShareCreatedFromPolicy and that\n operation is still in progress. This value changes to STANDARD when complete.", "type": "string" }, "lastUpdatedTime": { "description": "The date and time when the resource share was last updated.", "format": "date-time", "type": "string" }, "owningAccountID": { "description": "The ID of the Amazon Web Services account that owns the resource share.", "type": "string" }, "status": { "description": "The current status of the resource share.", "type": "string" }, "statusMessage": { "description": "A message about the status of the resource share.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object" }