Grants one or more principals (user, group, or resource) access to one or more entities (resource or group). The request body is batched to match the GraphQL addRoleAssignments mutation, which this endpoint thin-wraps. The caller must hold the EDIT_ASSIGNMENTS role permission on every entity in the batch.

Omit access_level_remote_id for entities that have a single default access level. Omit duration_minutes (or send 0) for an indefinite grant.

Atomicity: the batch is applied as a single transaction. If any entry fails input validation, authorization, lookup, or creation, no entries are created and the response identifies the first failing entry's entity_id and principal_id (and the request-array index for input validation errors). Clients should retry with the offending entry removed; partial-success is intentionally not supported, matching the semantics of the GraphQL addRoleAssignments mutation that this endpoint wraps.

Prefer this endpoint for batch or programmatic use (e.g. Terraform). For a single grant on a specific entity/principal pair, the per-pair endpoints — /resources/{id}/users/{id}, /groups/{id}/users/{id}, /groups/{id}/resources/{id}, /groups/{id}/containing-groups, /resources/{id}/non-human-identities/{id} — are often simpler.

{
  "role_assignments": [
    {
      "entity_id": "1b978423-db0a-4037-a4cf-f79c60cb67b3",
      "entity_type": "GROUP",
      "principal_id": "29827fb8-f2dd-4e80-9576-28e31e9934ac",
      "principal_type": "GROUP"
    }
  ]
}

{
  "entries": [
    {
      "role_assignment": {
        "entity_type": "GROUP",
        "principal_type": "GROUP",
        "access_level": {
          "access_level_name": "AdminRole",
          "access_level_remote_id": "arn:aws:iam::590304332660:role/AdministratorAccess"
        }
      }
    }
  ]
}