Skip to content
AWS for Query.Farm

aws.opsworks.describe_permissions

Example SQL Queries

SELECT * FROM
aws.opsworks.describe_permissions;

Description

Describes the permissions for a specified stack.

Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.

Table Definition

Column NameColumn Data Type
iam_user_arn Input Column

The user's IAM ARN. This can also be a federated user's ARN. For more information about IAM ARNs, see Using Identifiers.

VARCHAR
stack_id Input Column

The stack ID.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
permissions

An array of Permission objects that describe the stack permissions.

  • If the request object contains only a stack ID, the array contains a Permission object with permissions for each of the stack IAM ARNs.

  • If the request object contains only an IAM ARN, the array contains a Permission object with permissions for each of the user's stack IDs.

  • If the request contains a stack ID and an IAM ARN, the array contains a single Permission object with permissions for the specified stack and IAM ARN.

STRUCT(
    "stack_id" VARCHAR,
    "iam_user_arn" VARCHAR,
    "allow_ssh" BOOLEAN,
    "allow_sudo" BOOLEAN,
    "level" VARCHAR
)[]
Show child fields
permissions[]
Show child fields
permissions[].allow_ssh

Whether the user can use SSH.

permissions[].allow_sudo

Whether the user can use sudo.

permissions[].iam_user_arn

The Amazon Resource Name (ARN) for an Identity and Access Management (IAM) role. For more information about IAM ARNs, see Using Identifiers.

permissions[].level

The user's permission level, which must be the following:

  • deny

  • show

  • deploy

  • manage

  • iam_only

For more information on the permissions associated with these levels, see Managing User Permissions

permissions[].stack_id

A stack ID.