associate_mpa_team
Associate an AWS MPA approval team with a sensitive key-management operation to require multi-party sign-off before it completes, preventing any single custodian from acting alone.
Instructions
Call this to put a sensitive key-management operation behind Multi-Party Approval, so it requires sign-off from an AWS MPA approval team before it takes effect.
This is the APC equivalent of the dual-control requirement PCI PIN places on key management: no single custodian can complete the operation alone. Associating a team does not itself need approval; it changes how the named operation behaves from then on.
Once associated, calls to the covered operation return with an MpaStatus of PENDING rather than completing. See import_key for what that means in practice.
Args: action: The operation to protect. Currently only IMPORT_ROOT_PUBLIC_KEY_CERTIFICATE is supported by APC. mpa_team_arn: ARN of the AWS Multi-Party Approval team, of the form arn:aws:mpa:::approval-team/ requester_comment: Optional reason for the change, max 200 characters. Appears in CloudTrail in plaintext — no sensitive data.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| mpa_team_arn | Yes | ||
| requester_comment | No |