[ aws . qldb ]

update-ledger-permissions-mode

Description

Updates the permissions mode of a ledger.

Warning

Before you switch to the STANDARD permissions mode, you must first create all required IAM policies and table tags to avoid disruption to your users. To learn more, see Migrating to the standard permissions mode in the Amazon QLDB Developer Guide .

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  update-ledger-permissions-mode
--name <value>
--permissions-mode <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--name (string)

The name of the ledger.

--permissions-mode (string)

The permissions mode to assign to the ledger. This parameter can have one of the following values:

• ALLOW_ALL : A legacy permissions mode that enables access control with API-level granularity for ledgers. This mode allows users who have the SendCommand API permission for this ledger to run all PartiQL commands (hence, ALLOW_ALL ) on any tables in the specified ledger. This mode disregards any table-level or command-level IAM permissions policies that you create for the ledger.

• STANDARD : (Recommended ) A permissions mode that enables access control with finer granularity for ledgers, tables, and PartiQL commands. By default, this mode denies all user requests to run any PartiQL commands on any tables in this ledger. To allow PartiQL commands to run, you must create IAM permissions policies for specific table resources and PartiQL actions, in addition to the SendCommand API permission for the ledger. For information, see Getting started with the standard permissions mode in the Amazon QLDB Developer Guide .

Note

We strongly recommend using the STANDARD permissions mode to maximize the security of your ledger data.

Possible values:

• ALLOW_ALL

• STANDARD

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Examples

Example 1: To update the permissions mode of a ledger to STANDARD

The following update-ledger-permissions-mode example assigns the STANDARD permissions mode to the specified ledger.

aws qldb update-ledger-permissions-mode \
    --name myExampleLedger \
    --permissions-mode STANDARD

Output:

{
    "Name": "myExampleLedger",
    "Arn": "arn:aws:qldb:us-west-2:123456789012:ledger/myExampleLedger",
    "PermissionsMode": "STANDARD"
}

Example 2: To update the permissions mode of a ledger to ALLOW_ALL

The following update-ledger-permissions-mode example assigns the ALLOW_ALL permissions mode to the specified ledger.

aws qldb update-ledger-permissions-mode \
    --name myExampleLedger \
    --permissions-mode ALLOW_ALL

Output:

{
    "Name": "myExampleLedger",
    "Arn": "arn:aws:qldb:us-west-2:123456789012:ledger/myExampleLedger",
    "PermissionsMode": "ALLOW_ALL"
}

For more information, see Basic Operations for Amazon QLDB Ledgers in the Amazon QLDB Developer Guide.

Output

Name -> (string)

The name of the ledger.

Arn -> (string)

The Amazon Resource Name (ARN) for the ledger.

PermissionsMode -> (string)

The current permissions mode of the ledger.