Skip to content
AWS for Query.Farm

aws.ram.list_principals

Example SQL Queries

SELECT * FROM
aws.ram.list_principals
WHERE
"resource_owner" = 'VALUE';

Description

Lists the principals that you are sharing resources with or that are sharing resources with you.

Table Definition

Column NameColumn Data Type
resource_owner Required Input Column

Specifies that you want to list information for only resource shares that match the following:

  • SELF – principals that your account is sharing resources with

  • OTHER-ACCOUNTS – principals that are sharing resources with your account

VARCHAR
principals Input Column

Specifies that you want to list information for only the listed principals.

You can include the following values:

  • An Amazon Web Services account ID, for example: 123456789012

  • An Amazon Resource Name (ARN) of an organization in Organizations, for example: organizations::123456789012:organization/o-exampleorgid

  • An ARN of an organizational unit (OU) in Organizations, for example: organizations::123456789012:ou/o-exampleorgid/ou-examplerootid-exampleouid123

  • An ARN of an IAM role, for example: iam::123456789012:role/rolename

  • An ARN of an IAM user, for example: iam::123456789012user/username

Not all resource types can be shared with IAM roles and users. For more information, see Sharing with IAM roles and users in the Resource Access Manager User Guide.

VARCHAR[]
Show child fields
principals[]
resource_arn Input Column

Specifies that you want to list principal information for the resource share with the specified Amazon Resource Name (ARN).

VARCHAR
resource_share_arns Input Column

Specifies that you want to list information for only principals associated with the resource shares specified by a list the Amazon Resource Names (ARNs).

VARCHAR[]
Show child fields
resource_share_arns[]
resource_type Input Column

Specifies that you want to list information for only principals associated with resource shares that include the specified resource type.

For a list of valid values, query the ListResourceTypes operation.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
creation_time

The date and time when the principal was associated with the resource share.

TIMESTAMP_S
external

Indicates the relationship between the Amazon Web Services account the principal belongs to and the account that owns the resource share:

  • True – The two accounts belong to same organization.

  • False – The two accounts do not belong to the same organization.

BOOLEAN
id

The ID of the principal that can be associated with a resource share.

VARCHAR
last_updated_time

The date and time when the association between the resource share and the principal was last updated.

TIMESTAMP_S
resource_share_arn

The Amazon Resource Name (ARN) of a resource share the principal is associated with.

VARCHAR