AWS - IAM

Amazon Web Services Identity and Access Management (IAM).

IT Services · AWS - IAM

Details

ID	`AWS - IAM`
Provider	Amazon
Category	IT Services
From Version	5.0.0
Docker Image	`demisto/boto3py3:1.0.0.10221838`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Amazon Web Services Identity and Access Management (IAM)

For detailed instructions about setting up authentication, see: AWS Integrations - Authentication.

Configure AWS - IAM in Cortex

Parameter	Description	Required
roleArn	Role Arn	False
roleSessionName	Role Session Name	False
defaultRegion	AWS Default Region	False
sessionDuration	Role Session Duration	False
access_key	Access Key	False
secret_key	Secret Key	False
timeout	The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.	False
retries	The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time.	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-iam-create-user

Creates a new IAM user for your AWS account.

Base Command

aws-iam-create-user

Input

Argument Name	Description	Required
userName	The name of the user to create.	Required
path	The path for the user name. This parameter is optional. If it is not included, it defaults to a slash (/).	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Users.UserName	string	The friendly name identifying the user.
AWS.IAM.Users.UserId	string	The stable and unique string identifying the user.
AWS.IAM.Users.Arn	string	The Amazon Resource Name (ARN) that identifies the user.
AWS.IAM.Users.CreateDate	date	The date and time, when the user was created.
AWS.IAM.Users.Path	string	The path to the user.

Command Example

!aws-iam-create-user userName=Test path=/testusers/

aws-iam-get-user

Retrieves information about the specified IAM user, including the user’s creation date, path, unique ID, and ARN.

Base Command

aws-iam-get-user

Input

Argument Name	Description	Required
userName	The name of the user to get information about.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Users.UserName	string	The friendly name identifying the user.
AWS.IAM.Users.UserId	string	The stable and unique string identifying the user.
AWS.IAM.Users.Arn	string	The Amazon Resource Name (ARN) that identifies the user.
AWS.IAM.Users.CreateDate	date	The date and time when the user was created.
AWS.IAM.Users.Path	string	The path to the user.
AWS.IAM.Users.PasswordLastUsed	date	The date and time, when the user’s password was last used to sign in to an AWS website.

Command Example

!aws-iam-get-user userName=test

aws-iam-list-users

Lists the IAM users, returns all users in the AWS account.

Base Command

aws-iam-list-users

Input

Argument Name	Description	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Users.UserName	string	The friendly name identifying the user.
AWS.IAM.Users.UserId	string	The stable and unique string identifying the user.
AWS.IAM.Users.Arn	string	The Amazon Resource Name (ARN) that identifies the user.
AWS.IAM.Users.CreateDate	date	The date and time when the user was created.
AWS.IAM.Users.Path	string	The path to the user.
AWS.IAM.Users.PasswordLastUsed	date	The date and time when the password was last used.

Command Example


### aws-iam-update-user

***
Updates the name and/or the path of the specified IAM user.

#### Base Command

`aws-iam-update-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| oldUserName | Name of the user to update. | Required |
| newUserName | New name for the user. Include this parameter only if you're changing the user's name. | Optional |
| newPath | New path for the IAM user. Include this parameter only if you're changing the user's path. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-update-user oldUserName=test newUserName=NewUserName34 newPath=/iamtest/```

### aws-iam-delete-user

***
Deletes the specified IAM user. The user must not belong to any groups or have any access keys, signing certificates, or attached policies.

#### Base Command

`aws-iam-delete-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-user userName=userName34```

### aws-iam-update-login-profile

***
Changes the password for the specified IAM user.

#### Base Command

`aws-iam-update-login-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user whose password you want to update. | Required |
| newPassword | The new password for the specified IAM user. | Required |
| passwordResetRequired | Allows this new password to be used only once by requiring the specified IAM user to set a new password on next sign-in. Possible values are: True, False. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-update-login-profile userName=userName34 newPassword=ArdVaEC@1#$F%g% passwordResetRequired=True raw-response=true```

### aws-iam-create-group

***
Creates a new iam group.

#### Base Command

`aws-iam-create-group`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| groupName | The name of the group to create. Do not include the path in this value. | Optional |
| path | The path to the group. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Groups.GroupName | string | The friendly name that identifies the group. |
| AWS.IAM.Groups.GroupId | string | The stable and unique string identifying the group. |
| AWS.IAM.Groups.Arn | string | The Amazon Resource Name \(ARN\) specifying the group. |
| AWS.IAM.Groups.CreateDate | date | The date and time when the group was created. |
| AWS.IAM.Groups.Path | string | The path to the group. |

#### Command Example

```!aws-iam-create-group groupName=test path=/testgroups/```

### aws-iam-list-groups

***
Lists all the IAM groups in the AWS account

#### Base Command

`aws-iam-list-groups`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Groups.GroupName | string | The friendly name that identifies the group. |
| AWS.IAM.Groups.GroupId | string | The stable and unique string identifying the group. |
| AWS.IAM.Groups.Arn | string | The Amazon Resource Name \(ARN\) specifying the group. |
| AWS.IAM.Groups.CreateDate | date | The date and time when the group was created. |
| AWS.IAM.Groups.Path | string | The path to the group. |

#### Command Example

```!aws-iam-list-groups```

### aws-iam-list-groups-for-user

***
Lists the IAM groups that the specified IAM user belongs to.

#### Base Command

`aws-iam-list-groups-for-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user to list groups for. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Users.Groups.GroupName | string | The friendly name that identifies the group. |
| AWS.IAM.Users.Groups.GroupId | string | The stable and unique string identifying the group |
| AWS.IAM.Users.Groups.Arn | string | The Amazon Resource Name \(ARN\) specifying the group. |
| AWS.IAM.Users.Groups.CreateDate | date | The date and time when the group was created. |
| AWS.IAM.Users.Groups.Path | string | The path to the group. |

#### Command Example

```aws-iam-list-groups-for-user userName=test```

### aws-iam-add-user-to-group

***
Adds the specified user to the specified group.

#### Base Command

`aws-iam-add-user-to-group`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user to add. | Required |
| groupName | The name of the group to update. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-add-user-to-group userName=userName34 groupName=test```

### aws-iam-create-access-key

***
Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is Active .

#### Base Command

`aws-iam-create-access-key`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the IAM user that the new key will belong to. If username is not provided, the account name configured in your integration will be used. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Users.AccessKeys.AccessKeyId | string | The ID for this access key. |
| AWS.IAM.Users.AccessKeys.SecretAccessKey | string | The secret key used to sign requests. |
| AWS.IAM.Users.AccessKeys.Status | string | The status of the access key. Active means that the key is valid for API calls, while Inactive means it is not. |
| AWS.IAM.Users.AccessKeys.CreateDate | date | The date when the access key was created. |

#### Command Example

```!aws-iam-create-access-key userName=userName34```

### aws-iam-update-access-key

***
Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow.

#### Base Command

`aws-iam-update-access-key`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user whose key you want to update. If username is not provided, the account name configured in your integration . | Optional |
| accessKeyId | The access key ID of the secret access key you want to update. | Required |
| status | The status you want to assign to the secret access key. Active means that the key can be used for API calls to AWS, while Inactive means that the key cannot be used. Possible values are: Active, Inactive. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-update-access-key userName=test accessKeyId=AKIAJSFAUQ7EDFPN7Y2D2A status=Inactive```

### aws-iam-list-access-keys-for-user

***
Returns information about the access key IDs associated with the specified IAM user.

#### Base Command

`aws-iam-list-access-keys-for-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Users.AccessKeys.AccessKeyId | string | The ID for this access key. |
| AWS.IAM.Users.AccessKeys.Status | string | The status of the access key. Active means the key is valid for API calls; Inactive means it is not. |
| AWS.IAM.Users.AccessKeys.CreateDate | date | The date when the access key was created. |
| AWS.IAM.Users.AccessKeys.UserName | string | The name of the IAM user that the key is associated with. |

#### Command Example

```!aws-iam-list-access-keys-for-user userName=userName34```

### aws-iam-list-policies

***
Lists all the managed policies that are available in your AWS account, including your own customer-defined managed policies and all AWS managed policies.

#### Base Command

`aws-iam-list-policies`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| scope | The scope to use for filtering the results. To list only AWS managed policies, set Scope to AWS. To list only the customer managed policies in your AWS account, set Scope to Local. Possible values are: All, AWS, Local. Default is All. | Optional |
| onlyAttached | A flag to filter the results to only the attached policies.  When OnlyAttached is true , the returned list contains only the policies that are attached to an IAM user, group, or role. When OnlyAttached is false , or when the parameter is not included, all policies are returned. Possible values are: True, False. Default is False. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Policies.PolicyName | string | The friendly name \(not ARN\) identifying the policy. |
| AWS.IAM.Policies.PolicyId | string | The stable and unique string identifying the policy. |
| AWS.IAM.Policies.Arn | string | The Amazon Resource Name \(ARN\). |
| AWS.IAM.Policies.Path | string | The path to the policy. |
| AWS.IAM.Policies.DefaultVersionId | string | The identifier for the version of the policy that is set as the default version. |
| AWS.IAM.Policies.IsAttachable | string | Specifies whether the policy can be attached to an IAM user, group, or role. |
| AWS.IAM.Policies.CreateDate | date | when the policy was created. |
| AWS.IAM.Policies.UpdateDate | date | when the policy was last updated. |
| AWS.IAM.Policies.AttachmentCount | number | The number of entities \(users, groups, and roles\) that the policy is attached to. |

#### Command Example

```!aws-iam-list-policies scope=AWS onlyAttached=True```

### aws-iam-list-roles

***
Lists all IAM roles

#### Base Command

`aws-iam-list-roles`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.Roles.CreateDate | date | The date and time when the role was created. |
| AWS.IAM.Roles.Path | string | The path to the role. |
| AWS.IAM.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter. |

#### Command Example

```!aws-iam-list-roles```

### aws-iam-attach-policy

***
Attaches the specified managed policy to the specified IAM Entity.

#### Base Command

`aws-iam-attach-policy`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| type | The Type of IAM Entity. Possible values are: User, Group, Role. | Required |
| entityName | The name (friendly name, not ARN) of the IAM Entity to attach the policy to. | Optional |
| policyArn | The Amazon Resource Name (ARN) of the IAM policy you want to attach. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-attach-policy type=User entityName=userName34 policyArn=arn:aws:iam::aws:policy/AmazonSQSFullAccess```

### aws-iam-detach-policy

***
Removes the specified managed policy from the specified IAM Entity.

#### Base Command

`aws-iam-detach-policy`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| type | IAM Entity Type. Possible values are: User, Group, Role. | Required |
| entityName | The name (friendly name, not ARN) of the IAM Entity to detach the policy from. | Optional |
| policyArn | The Amazon Resource Name (ARN) of the IAM policy you want to detach. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-detach-policy type=User entityName=userName34 policyArn=arn:aws:iam::aws:policy/AmazonSQSFullAccess```

### aws-iam-delete-login-profile

***
Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console.

#### Base Command

`aws-iam-delete-login-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user whose password you want to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-login-profile userName=userName34```

### aws-iam-delete-group

***
Deletes the specified IAM group. The group must not contain any users or have any attached policies.

#### Base Command

`aws-iam-delete-group`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| groupName | The name of the IAM group to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-group groupName=Group123```

### aws-iam-remove-user-from-group

***
Removes the specified user from the specified group.

#### Base Command

`aws-iam-remove-user-from-group`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the user to remove. | Required |
| groupName | The name of the group to update. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-remove-user-from-group userName=userName34 groupName=Group123```

### aws-iam-create-login-profile

***
Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console.

#### Base Command

`aws-iam-create-login-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | The name of the IAM user to create a password for. The user must already exist. | Required |
| password | The new password for the user. | Required |
| passwordResetRequired | Specifies whether the user is required to set a new password on next sign-in. Possible values are: True, False. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-create-login-profile userName=userName34 password=Avd#sdf$12VB6*cvg passwordResetRequired=True```

### aws-iam-delete-access-key

***
Deletes the access key pair associated with the specified IAM user.

#### Base Command

`aws-iam-delete-access-key`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| userName | he name of the user whose access key pair you want to delete. If username is not provided, the account name configured in your integration will be used. | Optional |
| AccessKeyId | The access key ID for the access key ID and secret access key you want to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-access-key userName=userName34 AccessKeyId=ABCDEFGGHDJQ7E7X5PADN7Y2D2A```

### aws-iam-create-instance-profile

***
Creates a new instance profile.

#### Base Command

`aws-iam-create-instance-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| instanceProfileName | The name of the instance profile to create. | Required |
| path | The path to the instance profile. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |

#### Command Example

```!aws-iam-create-instance-profile instanceProfileName=testprofile path=/test/```

### aws-iam-delete-instance-profile

***
Deletes the specified instance profile. The instance profile must not have an associated role.

#### Base Command

`aws-iam-delete-instance-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| instanceProfileName | The name of the instance profile to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-instance-profile instanceProfileName=testprofile```

### aws-iam-list-instance-profiles

***
Lists all the instance profiles tin your AWS account.

#### Base Command

`aws-iam-list-instance-profiles`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |
| AWS.IAM.InstanceProfiles.Roles.Path | string | The path to the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.InstanceProfiles.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.InstanceProfiles.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.InstanceProfiles.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

```!aws-iam-list-instance-profiles```

### aws-iam-add-role-to-instance-profile

***
Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this limit cannot be increased. You can remove the existing role and then add a different role to an instance profile.

#### Base Command

`aws-iam-add-role-to-instance-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| instanceProfileName | The name of the instance profile to update. | Required |
| roleName | The name of the role to add. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |
| AWS.IAM.InstanceProfiles.Roles.Path | string | The path to the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.InstanceProfiles.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.InstanceProfiles.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.InstanceProfiles.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

```!aws-iam-add-role-to-instance-profile instanceProfileName=testprofile roleName=EC2ReadOnly```

### aws-iam-remove-role-from-instance-profile

***
Removes the specified IAM role from the specified EC2 instance profile.

#### Base Command

`aws-iam-remove-role-from-instance-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| instanceProfileName | The name of the instance profile to update. | Required |
| roleName | The name of the role to remove. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |
| AWS.IAM.InstanceProfiles.Roles.Path | string | The path to the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.InstanceProfiles.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.InstanceProfiles.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.InstanceProfiles.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

```!aws-iam-remove-role-from-instance-profile instanceProfileName=testprofile roleName=EC2ReadOnly```

### aws-iam-list-instance-profiles-for-role

***
Lists the instance profiles that have the specified associated IAM role.

#### Base Command

`aws-iam-list-instance-profiles-for-role`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleName | The name of the role to list instance profiles for. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |
| AWS.IAM.InstanceProfiles.Roles.Path | string | The path to the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.InstanceProfiles.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.InstanceProfiles.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.InstanceProfiles.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

```!aws-iam-list-instance-profiles-for-role roleName=EC2ReadOnly```

### aws-iam-get-instance-profile

***
Retrieves information about the specified instance profile.

#### Base Command

`aws-iam-get-instance-profile`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| instanceProfileName | The name of the instance profile to get information about. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.InstanceProfiles.Path | string | The path to the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileName | string | The name identifying the instance profile. |
| AWS.IAM.InstanceProfiles.InstanceProfileId | string | The stable and unique string identifying the instance profile. |
| AWS.IAM.InstanceProfiles.Arn | string | The Amazon Resource Name \(ARN\) specifying the instance profile. |
| AWS.IAM.InstanceProfiles.CreateDate | date | The date when the instance profile was created. |
| AWS.IAM.InstanceProfiles.Roles.Path | string | The path to the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.InstanceProfiles.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.InstanceProfiles.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.InstanceProfiles.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.InstanceProfiles.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.InstanceProfiles.Roles. MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

```!aws-iam-get-instance-profile instanceProfileName=testprofile```

### aws-iam-get-role

***
Retrieves information about the specified role.

#### Base Command

`aws-iam-get-role`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleName | The name of the IAM role to get information about. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Roles.Path | string | The path to the role. |
| AWS.IAM.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.Roles.AssumeRolePolicyDocument | string | The policy that grants an entity permission to assume the role. |
| AWS.IAM.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |
| AWS.IAM.Roles.Tags.Key | string | The tag key. |
| AWS.IAM.Roles.Tags.Value | string | The tag value. |

#### Command Example

```!aws-iam-get-role roleName=ec2readonly```

### aws-iam-delete-role

***
Deletes the specified role. The role must not have any policies attached.

#### Base Command

`aws-iam-delete-role`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleName | The name of the role to delete. | Required |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!aws-iam-delete-role roleName=test-role```

### aws-iam-create-role

***
Creates a new role for your AWS account.

#### Base Command

`aws-iam-create-role`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| roleName | The name of the role to create. | Required |
| assumeRolePolicyDocument | The trust relationship policy document that grants an entity permission to assume the role. | Required |
| path | The path to the role. | Optional |
| description | A description of the role. | Optional |
| maxSessionDuration | The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours. | Optional |
| roleArn | The Amazon Resource Name (ARN) of the role to assume. | Optional |
| roleSessionName | An identifier for the assumed role session. | Optional |
| roleSessionDuration | The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AWS.IAM.Roles.RoleName | string | The friendly name that identifies the role. |
| AWS.IAM.Roles.RoleId | string | The stable and unique string identifying the role. |
| AWS.IAM.Roles.Arn | string | The Amazon Resource Name \(ARN\) specifying the role. |
| AWS.IAM.Roles.CreateDate | date | The date and time, when the role was created. |
| AWS.IAM.Roles.Path | string | The path to the role. |
| AWS.IAM.Roles.AssumeRolePolicyDocument | string | he policy that grants an entity permission to assume the role. |
| AWS.IAM.Roles.Description | string | A description of the role that you provide. |
| AWS.IAM.Roles.MaxSessionDuration | number | The maximum session duration \(in seconds\) for the specified role. |

#### Command Example

!aws-iam-create-role roleName=testrole assumeRolePolicyDocument="{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}" description="a test role"   ```

aws-iam-create-policy

Creates a new managed policy for your AWS account. This operation creates a policy version with a version identifier of v1 and sets v1 as the policy’s default version.

Base Command

aws-iam-create-policy

Input

Argument Name	Description	Required
policyName	The friendly name of the policy.	Required
policyDocument	The JSON policy document that you want to use as the content for the new policy.	Required
path	The path for the policy.	Optional
description	A friendly description of the policy.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Policies.PolicyName	string	The friendly name (not ARN) identifying the policy.
AWS.IAM.Policies.PolicyId	string	The stable and unique string identifying the policy.
AWS.IAM.Policies.Arn	string	The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
AWS.IAM.Policies.Path	string	The path to the policy.
AWS.IAM.Policies.DefaultVersionId	string	The identifier for the version of the policy that is set as the default version.
AWS.IAM.Policies.AttachmentCount	number	The number of entities (users, groups, and roles) that the policy is attached to.
AWS.IAM.Policies.PermissionsBoundaryUsageCount	number	The number of entities (users and roles) for which the policy is used to set the permissions boundary.
AWS.IAM.Policies.IsAttachable	boolean	Specifies whether the policy can be attached to an IAM user, group, or role.
AWS.IAM.Policies.Description	string	A friendly description of the policy.
AWS.IAM.Policies.CreateDate	date	The date and time, in ISO 8601 date-time format , when the policy was created.
AWS.IAM.Policies.UpdateDate	date	The date and time, in ISO 8601 date-time format , when the policy was last updated.

Command Example

!aws-iam-create-policy policyName=test-policy policyDocument="{  
"Version": "2012-10-17",  
"Statement": \[  
{  
"Sid": "VisualEditor0",  
"Effect": "Allow",  
"Action": "guardduty:CreateIPSet",  
"Resource": "arn:aws:guardduty:_:_:detector/_"  
},  
{  
"Sid": "VisualEditor1",  
"Effect": "Allow",  
"Action": "guardduty:CreateDetector",  
"Resource": "_"  
}  
\]  
}"

aws-iam-delete-policy

Deletes the specified managed policy. Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to. In addition you must delete all the policy’s versions.

Base Command

aws-iam-delete-policy

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy you want to delete.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-policy policyArn=arn:aws:iam::123456789:policy/test-policy

aws-iam-create-policy-version

Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version. Optionally, you can set the new version as the policy’s default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached.

Base Command

aws-iam-create-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version.	Required
policyDocument	The JSON policy document that you want to use as the content for this new version of the policy.	Required
setAsDefault	Specifies whether to set this version as the policy’s default version. Possible values are: True, False.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Policies.Versions.Document	string	The policy document.
AWS.IAM.Policies.Versions.VersionId	string	The identifier for the policy version.
AWS.IAM.Policies.Versions.IsDefaultVersion	string	The identifier for the policy version.
AWS.IAM.Policies.Versions.CreateDate	string	The date and time, in ISO 8601 date-time format , when the policy version was created.

Command Example

!aws-iam-create-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy policyDocument="{  
"Version": "2012-10-17",  
"Statement": \[  
{  
"Sid": "VisualEditor0",  
"Effect": "Allow",  
"Action": "guardduty:CreateIPSet",  
"Resource": "arn:aws:guardduty:_:_:detector/_"  
},  
{  
"Sid": "VisualEditor1",  
"Effect": "Allow",  
"Action": "guardduty:CreateDetector",  
"Resource": "_"  
}  
\]  
}" setAsDefault=True

aws-iam-delete-policy-version

Deletes the specified version from the specified managed policy. You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy . To find out which version of a policy is marked as the default version, use ListPolicyVersions .

Base Command

aws-iam-delete-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy from which you want to delete a version.	Required
versionId	The policy version to delete.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v1

aws-iam-list-policy-versions

Lists information about the versions of the specified managed policy, including the version that is currently set as the policy’s default version.

Base Command

aws-iam-list-policy-versions

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.	Required

Context Output

Path	Type	Description
AWS.IAM.Policies.Versions.Document	string	The policy document.
AWS.IAM.Policies.Versions.VersionId	string	The identifier for the policy version.
AWS.IAM.Policies.Versions.IsDefaultVersion	boolean	Specifies whether the policy version is set as the policy’s default version.
AWS.IAM.Policies.Versions.CreateDate	date	The date and time, in ISO 8601 date-time format , when the policy version was created.

Command Example

!aws-iam-list-policy-versions policyArn=arn:aws:iam::123456789:policy/test-policy

aws-iam-get-policy-version

Retrieves information about the specified version of the specified managed policy, including the policy document.

Base Command

aws-iam-get-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the managed policy that you want information about.	Required
versionId	Identifies the policy version to retrieve.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Policies.Versions.Document	unknown	The policy document.
AWS.IAM.Policies.Versions.VersionId	unknown	The identifier for the policy version.
AWS.IAM.Policies.Versions.IsDefaultVersion	unknown	Specifies whether the policy version is set as the policy’s default version.
AWS.IAM.Policies.Versions.CreateDate	unknown	The date and time, in ISO 8601 date-time format , when the policy version was created.

Command Example

!aws-iam-get-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v3

aws-iam-set-default-policy-version

Sets the specified version of the specified policy as the policy’s default (operative) version. This operation affects all users, groups, and roles that the policy is attached to.

Base Command

aws-iam-set-default-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy whose default version you want to set.	Required
versionId	The version of the policy to set as the default (operative) version.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-set-default-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v2

aws-iam-create-account-alias

Creates an alias for your AWS account.

Base Command

aws-iam-create-account-alias

Input

Argument Name	Description	Required
accountAlias	The account alias to create.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-create-account-alias accountAlias=test-alias

aws-iam-delete-account-alias

Deletes the specified AWS account alias.

Base Command

aws-iam-delete-account-alias

Input

Argument Name	Description	Required
accountAlias	The name of the account alias to delete.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-account-alias accountAlias=demisto-test-alias

aws-iam-get-account-password-policy

Get AWS account’s password policy

Base Command

aws-iam-get-account-password-policy

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
AWS.IAM.PasswordPolicy	Unknown	Account’s password policy.

aws-iam-update-account-password-policy

Create/update password policy

Base Command

aws-iam-update-account-password-policy

Input

Argument Name	Description	Required
minimumPasswordLength	The minimum number of characters allowed in an IAM user password. Possible values are: .	Optional
requireSymbols	Specifies whether IAM user passwords must contain at least one of the non-alphanumeric characters. Can be “True” or “False”. Possible values are: True, False.	Optional
requireNumbers	Specifies whether IAM user passwords must contain at least one numeric character (0 to 9). Can be “True” or “False”. Possible values are: True, False.	Optional
requireUppercaseCharacters	Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be “True” or “False”. Possible values are: True, False.	Optional
requireLowercaseCharacters	Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be “True” or “False”. Possible values are: True, False.	Optional
allowUsersToChangePassword	Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be “True” or “False”. Possible values are: True, False.	Optional
maxPasswordAge	The number of days that an IAM user password is valid. Possible values are: .	Optional
passwordReusePrevention	Specifies the number of previous passwords that IAM users are prevented from reusing. Possible values are: .	Optional
hardExpiry	Prevents IAM users from setting a new password after their password has expired. Can be “True” or “False”. Possible values are: True, False.	Optional

Context Output

There is no context output for this command.

aws-iam-list-role-policies

Lists the names of the inline policies that are embedded in the specified IAM role.

Base Command

aws-iam-list-role-policies

Input

Argument Name	Description	Required
roleName	The name of the role to list policies for.	Required

Context Output

Path	Type	Description
AWS.IAM.Roles.RoleName.Policies	Unknown	A list of policy names.

Command Example

!aws-iam-list-role-policies roleName=test-RoleARN

aws-iam-get-role-policy

Retrieves the specified inline policy document that is embedded with the specified IAM role.

Base Command

aws-iam-get-role-policy

Input

Argument Name	Description	Required
roleName	The name of the role associated with the policy.	Required
policyName	The name of the policy document to get.	Required

Context Output

Path	Type	Description
AWS.IAM.Roles.PolicyDocument	string	The policy document.

Command Example

!aws-iam-get-role-policy roleName=test-RoleARN policyName=testPolicy

aws-iam-get-policy

Retrieves information about the specified managed policy, including the policy’s default version and the total number of
IAM users, groups, and roles to which the policy is attached.

Base Command

aws-iam-get-policy

Input

Argument Name	Description	Required
policyName	The Amazon Resource Name (ARN) of the managed policy that you want information about.	Required

Context Output

Path	Type	Description
AWS.IAM.Policy.PolicyName	string	The friendly name (not ARN) identifying the policy.
AWS.IAM.Policy.PolicyId	string	The stable and unique string identifying the policy.
AWS.IAM.Policy.Arn	string	The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
AWS.IAM.Policy.Path	string	The path to the policy.
AWS.IAM.Policy.Description	string	A friendly description of the policy.

Command Example

!aws-iam-get-policy policyName=testPolicy

aws-iam-list-user-policies

Lists the names of the inline policies embedded in the specified IAM user.

Base Command

aws-iam-list-user-policies

Input

Argument Name	Description	Required
userName	The name (friendly name, not ARN) of the user to list inline policies for.	Required
limit	Number of results to display. Default value is 50.	Optional
page	Page number you would like to view. Each page contains page_size values. Must be used along with page_size.	Optional
page_size	Number of results per page to display.	Optional
marker	Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker).	Optional

Context Output

Path	Type	Description
AWS.IAM.UserPolicies.UserName	string	A list of the user’s inline policy names.
AWS.IAM.UserPolicies.PolicyName	string	The name of the policy.
AWS.IAM.Users.InlinePoliciesMarker	string	First element of next page of items.

Command Example

!aws-iam-list-user-policies userName=testUser

aws-iam-list-attached-user-polices

Lists all managed policies that are attached to the specified IAM user.

Base Command

aws-iam-list-attached-user-policies

Input

Argument Name	Description	Required
userName	The name (friendly name, not ARN) of the user to list attached policies for.	Required
limit	Number of results to display. Default value is 50.	Optional
page	Page number you would like to view. Each page contains page_size values. Must be used along with page_size.	Optional
page_size	Number of results per page to display.	Optional
marker	Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker).	Optional

Context Output

Path	Type	Description
AWS.IAM.AttachedUserPolicies.UserName	string	The name (friendly name, not ARN) of the user to list attached policies for.
AWS.IAM.AttachedUserPolicies.PolicyName	string	Policy Name
AWS.IAM.AttachedUserPolicies.PolicyArn	string	The Amazon Resource Name (ARN) of the attached policy.
AWS.IAM.Users.AttachedPoliciesMarker	string	First element of next page of items.

Command Example

!aws-iam-list-attached-user-policies userName=testUser

aws-iam-list-attached-group-policies

Lists all managed policies that are attached to the specified IAM group.

Base Command

aws-iam-list-attached-group-policies

Input

Argument Name	Description	Required
groupName	The name (friendly name, not ARN) of the group to list attached policies for.	Required
limit	Number of results to display. Default value is 50.	Optional
page	Page number you would like to view. Each page contains page_size values. Must be used along with page_size.	Optional
page_size	Number of results per page to display.	Optional
marker	Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker).	Optional

Context Output

Path	Type	Description
AWS.IAM.AttachedGroupPolicies.GroupName	string	The name (friendly name, not ARN) of the group to list attached policies for.
AWS.IAM.AttachedGroupPolicies.PolicyName	string	Policy Name
AWS.IAM.AttachedGroupPolicies.PolicyArn	string	The Amazon Resource Name (ARN) of the attached policy.
AWS.IAM.Groups.AttachedPoliciesMarker	string	First element of next page of items.

Command Example

!aws-iam-list-attached-group-policies groupName=testGroup

aws-iam-get-user-login-profile

Lists all managed policies that are attached to the specified IAM user.

Base Command

aws-iam-get-user-login-profile

Input

Argument Name	Description	Required
userName	The name (friendly name, not ARN) of the user to retrieve login profile for.	Required

Context Output

Path	Type	Description
AWS.IAM.Users.LoginProfile.CreateDate	date	The date when the password for the user was created.
AWS.IAM.Users.LoginProfile.PasswordResetRequired	boolean	Specifies whether the user is required to set a new password on next sign-in.

Command Example

!aws-iam-get-user-login-profile userName=testUser

aws-iam-put-role-policy

Adds or updates an inline policy document that is embedded in the specified IAM role.

Base Command

aws-iam-put-role-policy

Input

Argument Name	Description	Required
policyDocument	The policy document. You must provide policies in JSON format in IAM.	Required
policyName	The name of the policy document.	Required
roleName	The name of the role to associate the policy with.	Required

Human Readable Output

Policy {policy_name} was added to role {role_name}

Context Output

There is no context output for this command.

aws-iam-put-user-policy

Adds or updates an inline policy document that is embedded in the specified IAM user.

Base Command

aws-iam-put-user-policy

Input

Argument Name	Description	Required
policyDocument	The policy document. You must provide policies in JSON format in IAM.	Required
policyName	The name of the policy document.	Required
userName	The name of the user to associate the policy with.	Required

Context Output

There is no context output for this command.

Human Readable Output

Policy {policy_name} was added to role {user_name}

aws-iam-put-group-policy

Adds or updates an inline policy document that is embedded in the specified IAM group.

Base Command

aws-iam-put-group-policy

Input

Argument Name	Description	Required
policyDocument	The policy document. You must provide policies in JSON format in IAM.	Required
policyName	The name of the policy document.	Required
groupName	The name of the group to associate the policy with.	Required

Context Output

There is no context output for this command.

Human Readable Output

Policy {policy_name} was added to role {group_name}

aws-iam-tag-role

Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value.

Base Command

aws-iam-tag-role

Input

Argument Name	Description	Required
roleName	The name of the IAM role to which you want to add tags.	Required
tags	A comma-separated list of Key:Value tag objects.	Required

Context Output

There is no context output for this command.

Human Readable Output

Added the following tags to role {role_name}

Key	Value
Key	Value

aws-iam-tag-user

Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value.

Base Command

aws-iam-tag-user

Input

Argument Name	Description	Required
userName	The name of the IAM user to which you want to add tags.	Required
tags	A comma-separated list of Key:Value tag objects.	Required

Context Output

There is no context output for this command.

Human Readable Output

Added the following tags to user {user_name}

Key	Value
Key	Value

aws-iam-untag-user

Removes the specified tags from the user.

Base Command

aws-iam-untag-user

Input

Argument Name	Description	Required
userName	The name of the IAM role to which you want to untag.	Required
tagKeys	A comma-separated list of tag keys.	Required

Context Output

There is no context output for this command.

Human Readable Output

Untagged the following tags from user {user_name}

Removed keys
Key1

aws-iam-untag-role

Removes the specified tags from the role.

Base Command

aws-iam-untag-role

Input

Argument Name	Description	Required
roleName	The name of the IAM role to which you want to untag.	Required
tagKeys	A comma-separated list of tag keys.	Required

Context Output

There is no context output for this command.

Human Readable Output

Untagged the following tags from role {role_name}

Removed keys
Key1

aws-iam-get-access-key-last-used

Retrieves information about when the specified access key was last used. The information includes the date and time of last use, along with the AWS service and region that were specified in the last request made with that key.

Base Command

aws-iam-get-access-key-last-used

Input

Argument Name	Description	Required
accessKeyId	The identifier of an access key.	Required

Context Output

Path	Type	Description
AWS.IAM.AccessKey.ID	string	The access key ID.
AWS.IAM.AccessKey.UserName	string	The username owning the given access key.
AWS.IAM.AccessKey.LastUsedServiceName	string	The name of the service that last used the given access key.
AWS.IAM.AccessKey.LastUsedRegion	string	The name of the region where the given access key was last used.
AWS.IAM.AccessKey.LastUsedDate	string	The date when the given access key was last used.

Human Readable Output

Found the following information about access key access_Key_Id

ID	UserName	LastUsedDate	LastUsedServiceName	LastUsedRegion
access_Key_Id	user_name	2023-06-06T14:32:00	test	Here

aws-iam-list-attached-role-policies

List all managed policies that are attached to the specified IAM role.

Base Command

aws-iam-list-attached-role-policies

Input

Argument Name	Description	Required
roleName	The name (friendly name, not ARN) of the role to list attached policies for.	Required
pathPrefix	The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies.	Optional
maxItems	The maximum number of items to return in the command’s output.	Optional
marker	Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.	Optional

Context Output

Path	Type	Description
AWS.IAM.Roles.AttachedPolicies.Policies.PolicyName	string	The policy name.
AWS.IAM.Roles.AttachedPolicies.Policies.PolicyArn	string	The policy ARN.
AWS.IAM.Roles.AttachedPolicies.Policies.RoleName	string	The queried role name.
AWS.IAM.Roles.AttachedPolicies.Query.IsTruncated	Boolean	Whether there are more items to return. If the results were truncated, make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. AWS recommends checking IsTruncated after every call to ensure that all results are received.
AWS.IAM.Roles.AttachedPolicies.Query.Marker	string	When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

Command example

!aws-iam-list-attached-role-policies roleName=myRoleName

Context Example

{
    "AWS": {
        "IAM": {
            "Roles": {
                "AttachedPolicies": {
                    "Policies": [
                        {
                            "PolicyArn": "arn:aws:iam::000000000000:policy/my-policy",
                            "PolicyName": "my-policy-name",
                            "RoleName": "myRoleName"
                        },
                        {
                            "PolicyArn": "arn:aws:iam::000000000001:policy/my-other-policy",
                            "PolicyName": "my-other-policy-name",
                            "RoleName": "myRoleName"
                        }
                    ],
                    "Query": {
                        "IsTruncated": false
                    }
                }
            }
        }
    }
}

Human Readable Output

Results

Attached Policies for Role myRoleName

PolicyArn	PolicyName	RoleName
arn:aws:iam::000000000000:policy/my-policy	my-policy-name	myRoleName
arn:aws:iam::000000000001:policy/my-other-policy	my-other-policy-name	myRoleName

Listed 2 attached policies for role test-role

aws-iam-list-mfa-devices

Lists the MFA devices for an IAM user.

Base Command

aws-iam-list-mfa-devices

Input

Argument Name	Description	Required
userName	The name of the user whose MFA devices you want to list.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional
marker	Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.	Optional

Context Output

Path	Type	Description
AWS.IAM.MFADevices.Devices.UserName	string	The user with whom the MFA device is associated.
AWS.IAM.MFADevices.Devices.SerialNumber	string	The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.
AWS.IAM.MFADevices.Devices.EnableDate	date	The date when the MFA device was enabled for the user.
MFADevices.Devices.Marker	string	First element of next page of items.

aws-iam-delete-mfa-devices

Deletes a virtual MFA device.

Base Command

aws-iam-delete-mfa-devices

Input

Argument Name	Description	Required
serialNumber	The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

aws-iam-deactivate-mfa-devices

Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled.

Base Command

aws-iam-deactivate-mfa-devices

Input

Argument Name	Description	Required
userName	The name of the user whose MFA devices you want to list.	Required
serialNumber	The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Configuration parameters

roleArn — Role Arn
roleSessionName — Role Session Name
defaultRegion — AWS Default Region (required)
sessionDuration — Role Session Duration
credentials — Access Key
access_key — Access Key
secret_key — Secret Key
timeout — Timeout
retries — Retries
sts_regional_endpoint — AWS STS Regional Endpoints
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (66)

aws-iam-access-key-update-quick-action
Immediately disables a specific IAM access key. This stops all CLI, SDK, and API-based communication for this key ID without deleting it, enabling forensic recovery or re-enabling if the key is found to be safe.
aws-iam-account-password-policy-update-quick-action
Updates the password policy to require a minimum length of 14 characters, at least one lowercase letter, one uppercase letter, one symbol. Allows users to reset password, disallow reuse of the last 24 passwords and set password expiration to 90 days. It runs the aws-iam-update-account-password-policy CLI command in your AWS environment and requires the 'iam:UpdateAccountPasswordPolicy' permission.
aws-iam-add-role-to-instance-profile
Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this limit cannot be increased. You can remove the existing role and then add a different role to an instance profile.
aws-iam-add-user-to-group
Adds the specified user to the specified group.
aws-iam-attach-policy
Attaches the specified managed policy to the specified IAM Entity.
aws-iam-create-access-key
Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is Active .
aws-iam-create-account-alias
Creates an alias for your AWS account.
aws-iam-create-group
Creates a new iam group.
aws-iam-create-instance-profile
Creates a new instance profile.
aws-iam-create-login-profile
Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console.
aws-iam-create-policy
Creates a new managed policy for your AWS account. This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version.
aws-iam-create-policy-version
Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version. Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached.
aws-iam-create-role
Creates a new role for your AWS account.
aws-iam-create-user
Creates a new IAM user for your AWS account.
aws-iam-deactivate-mfa-devices
Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled.
aws-iam-delete-access-key
Deletes the access key pair associated with the specified IAM user.
aws-iam-delete-account-alias
Deletes the specified AWS account alias.
aws-iam-delete-group
Deletes the specified IAM group. The group must not contain any users or have any attached policies.
aws-iam-delete-instance-profile
Deletes the specified instance profile. The instance profile must not have an associated role.
aws-iam-delete-login-profile
Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console.
aws-iam-delete-mfa-devices
Deletes a virtual MFA device.
aws-iam-delete-policy
Deletes the specified managed policy. Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to. In addition you must delete all the policy's versions.
aws-iam-delete-policy-version
Deletes the specified version from the specified managed policy. You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy . To find out which version of a policy is marked as the default version, use ListPolicyVersions .
aws-iam-delete-role
Deletes the specified role. The role must not have any policies attached.
aws-iam-delete-user
Deletes the specified IAM user. The user must not belong to any groups or have any access keys, signing certificates, or attached policies.
aws-iam-detach-policy
Removes the specified managed policy from the specified IAM Entity.
aws-iam-get-access-key-last-used
Retrieves information about when the specified access key was last used. The information includes the date and time of last use, along with the AWS service and region that were specified in the last request made with that key.
aws-iam-get-account-password-policy
Get AWS account's password policy.
aws-iam-get-instance-profile
Retrieves information about the specified instance profile.
aws-iam-get-policy
Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached.
aws-iam-get-policy-version
Retrieves information about the specified version of the specified managed policy, including the policy document.
aws-iam-get-role
Retrieves information about the specified role.
aws-iam-get-role-policy
Retrieves the specified inline policy document that is embedded with the specified IAM role.
aws-iam-get-user
Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.
aws-iam-get-user-login-profile
Retrieves the user login profile information for AWS management consle.
aws-iam-list-access-keys-for-user
Returns information about the access key IDs associated with the specified IAM user.
aws-iam-list-attached-group-policies
Lists all managed policies that are attached to the specified IAM group.
aws-iam-list-attached-role-policies
List all managed policies that are attached to the specified IAM role.
aws-iam-list-attached-user-policies
Lists all managed policies that are attached to the specified IAM user.
aws-iam-list-groups
Lists all the IAM groups in the AWS account.
aws-iam-list-groups-for-user
Lists the IAM groups that the specified IAM user belongs to.
aws-iam-list-instance-profiles
Lists all the instance profiles tin your AWS account.
aws-iam-list-instance-profiles-for-role
Lists the instance profiles that have the specified associated IAM role.
aws-iam-list-mfa-devices
Lists the MFA devices for an IAM user.
aws-iam-list-policies
Lists all the managed policies that are available in your AWS account, including your own customer-defined managed policies and all AWS managed policies.
aws-iam-list-policy-versions
Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.
aws-iam-list-role-policies
Lists the names of the inline policies that are embedded in the specified IAM role.
aws-iam-list-roles
Lists all IAM roles.
aws-iam-list-user-policies
Lists the names of the inline policies embedded in the specified IAM user.
aws-iam-list-users
Lists the IAM users, returns all users in the AWS account.
aws-iam-login-profile-delete-quick-action
Permanently deletes the IAM user's password (login profile). This prevents the user from signing into the AWS Management Console but does not deactivate their programmatic access keys or delete the IAM user itself.
aws-iam-put-group-policy
Adds or updates an inline policy document that is embedded in the specified IAM group.
aws-iam-put-role-policy
Adds or updates an inline policy document that is embedded in the specified IAM role.
aws-iam-put-user-policy
Adds or updates an inline policy document that is embedded in the specified IAM user.
aws-iam-remove-role-from-instance-profile
Removes the specified IAM role from the specified EC2 instance profile.
aws-iam-remove-user-from-group
Removes the specified user from the specified group.
aws-iam-set-default-policy-version
Sets the specified version of the specified policy as the policy's default (operative) version. This operation affects all users, groups, and roles that the policy is attached to.
aws-iam-tag-role
Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value.
aws-iam-tag-user
Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value.
aws-iam-untag-role
Removes the specified tags from the role.
aws-iam-untag-user
Removes the specified tags from the user.
aws-iam-update-access-key
Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow.
aws-iam-update-account-password-policy
Create/update password policy.
aws-iam-update-login-profile
Changes the password for the specified IAM user.
aws-iam-update-user
Updates the name and/or the path of the specified IAM user.
aws-iam-user-policy-put-quick-action
Attaches an inline "Deny All" policy for the specified IAM user, effectively blocking the user from performing any actions on all AWS resources.

Source

AWS-IAM.py AWS-IAM_test.py AWS-IAM.yml AWS-IAM_description.md

Download History Raw

category: IT Services
provider: Amazon
sectionorder:
- Connect
- Collect
commonfields:
  id: AWS - IAM
  version: -1
configuration:
- display: Role Arn
  name: roleArn
  type: 0
  section: Connect
  required: false
- display: Role Session Name
  name: roleSessionName
  type: 0
  section: Connect
  required: false
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  advanced: true
  required: true
- display: Role Session Duration
  name: sessionDuration
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: false
- display: Access Key
  name: access_key
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  section: Connect
  required: false
- additionalinfo: The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.
  defaultvalue: 60,10
  display: Timeout
  name: timeout
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time.'
  defaultvalue: '5'
  display: Retries
  name: retries
  type: 0
  section: Connect
  advanced: true
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Amazon Web Services Identity and Access Management (IAM).
display: AWS - Identity and Access Management
name: AWS - IAM
script:
  commands:
  - arguments:
    - description: The name of the user to create.
      name: userName
      required: true
    - description: The path for the user name. This parameter is optional. If it is not included, it defaults to a slash (/).
      name: path
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new IAM user for your AWS account.
    name: aws-iam-create-user
    outputs:
    - contextPath: AWS.IAM.Users.UserName
      description: The friendly name identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.UserId
      description: The stable and unique string identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.Arn
      description: The Amazon Resource Name (ARN) that identifies the user.
      type: string
    - contextPath: AWS.IAM.Users.CreateDate
      description: The date and time, when the user was created.
      type: date
    - contextPath: AWS.IAM.Users.Path
      description: The path to the user.
      type: string
  - arguments:
    - description: The name of the user to get information about.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.
    name: aws-iam-get-user
    outputs:
    - contextPath: AWS.IAM.Users.UserName
      description: The friendly name identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.UserId
      description: The stable and unique string identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.Arn
      description: The Amazon Resource Name (ARN) that identifies the user.
      type: string
    - contextPath: AWS.IAM.Users.CreateDate
      description: The date and time when the user was created.
      type: date
    - contextPath: AWS.IAM.Users.Path
      description: The path to the user.
      type: string
    - contextPath: AWS.IAM.Users.PasswordLastUsed
      description: The date and time,  when the user's password was last used to sign in to an AWS website.
      type: date
  - arguments:
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists the IAM users, returns all users in the AWS account.
    name: aws-iam-list-users
    outputs:
    - contextPath: AWS.IAM.Users.UserName
      description: The friendly name identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.UserId
      description: The stable and unique string identifying the user.
      type: string
    - contextPath: AWS.IAM.Users.Arn
      description: The Amazon Resource Name (ARN) that identifies the user.
      type: string
    - contextPath: AWS.IAM.Users.CreateDate
      description: The date and time when the user was created.
      type: date
    - contextPath: AWS.IAM.Users.Path
      description: The path to the user.
      type: string
    - contextPath: AWS.IAM.Users.PasswordLastUsed
      description: The date and time when the password was last used.
      type: date
  - arguments:
    - description: Name of the user to update.
      name: oldUserName
      required: true
    - description: New name for the user. Include this parameter only if you're changing the user's name.
      name: newUserName
    - description: New path for the IAM user. Include this parameter only if you're changing the user's path.
      name: newPath
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates the name and/or the path of the specified IAM user.
    name: aws-iam-update-user
  - arguments:
    - description: The name of the user to delete.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified IAM user. The user must not belong to any groups or have any access keys, signing certificates, or attached policies.
    name: aws-iam-delete-user
  - arguments:
    - description: The name of the user whose password you want to update.
      name: userName
      required: true
    - description: The new password for the specified IAM user.
      name: newPassword
      required: false
    - auto: PREDEFINED
      description: Requires the specified IAM user to set a new password at the next sign-in. The temporary password can be used only once.
      name: passwordResetRequired
      predefined:
      - 'True'
      - 'False'
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Changes the password for the specified IAM user.
    name: aws-iam-update-login-profile
  - arguments:
    - description: The name of the group to create. Do not include the path in this value.
      name: groupName
    - description: The path to the group.
      name: path
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new iam group.
    name: aws-iam-create-group
    outputs:
    - contextPath: AWS.IAM.Groups.GroupName
      description: The friendly name that identifies the group.
      type: string
    - contextPath: AWS.IAM.Groups.GroupId
      description: The stable and unique string identifying the group.
      type: string
    - contextPath: AWS.IAM.Groups.Arn
      description: The Amazon Resource Name (ARN) specifying the group.
      type: string
    - contextPath: AWS.IAM.Groups.CreateDate
      description: The date and time when the group was created.
      type: date
    - contextPath: AWS.IAM.Groups.Path
      description: The path to the group.
      type: string
  - arguments:
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all the IAM groups in the AWS account.
    name: aws-iam-list-groups
    outputs:
    - contextPath: AWS.IAM.Groups.GroupName
      description: The friendly name that identifies the group.
      type: string
    - contextPath: AWS.IAM.Groups.GroupId
      description: The stable and unique string identifying the group.
      type: string
    - contextPath: AWS.IAM.Groups.Arn
      description: The Amazon Resource Name (ARN) specifying the group.
      type: string
    - contextPath: AWS.IAM.Groups.CreateDate
      description: The date and time when the group was created.
      type: date
    - contextPath: AWS.IAM.Groups.Path
      description: The path to the group.
      type: string
  - arguments:
    - description: The name of the user to list groups for.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists the IAM groups that the specified IAM user belongs to.
    name: aws-iam-list-groups-for-user
    outputs:
    - contextPath: AWS.IAM.Users.Groups.GroupName
      description: The friendly name that identifies the group.
      type: string
    - contextPath: AWS.IAM.Users.Groups.GroupId
      description: The stable and unique string identifying the group.
      type: string
    - contextPath: AWS.IAM.Users.Groups.Arn
      description: The Amazon Resource Name (ARN) specifying the group.
      type: string
    - contextPath: AWS.IAM.Users.Groups.CreateDate
      description: The date and time when the group was created.
      type: date
    - contextPath: AWS.IAM.Users.Groups.Path
      description: The path to the group.
      type: string
  - arguments:
    - description: The name of the user to add.
      name: userName
      required: true
    - description: The name of the group to update.
      name: groupName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Adds the specified user to the specified group.
    name: aws-iam-add-user-to-group
  - arguments:
    - description: The name of the IAM user that the new key will belong to. If username is not provided, the account name configured in your integration will be used.
      name: userName
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is Active .
    name: aws-iam-create-access-key
    outputs:
    - contextPath: AWS.IAM.Users.AccessKeys.AccessKeyId
      description: The ID for this access key.
      type: string
    - contextPath: AWS.IAM.Users.AccessKeys.SecretAccessKey
      description: The secret key used to sign requests.
      type: string
    - contextPath: AWS.IAM.Users.AccessKeys.Status
      description: The status of the access key. Active means that the key is valid for API calls, while Inactive means it is not.
      type: string
    - contextPath: AWS.IAM.Users.AccessKeys.CreateDate
      description: The date when the access key was created.
      type: date
  - arguments:
    - description: The name of the user whose key you want to update. If username is not provided, the account name configured in your integration will be used.
      name: userName
    - description: The access key ID of the secret access key you want to update.
      name: accessKeyId
      required: true
    - auto: PREDEFINED
      description: The status you want to assign to the secret access key. Active means that the key can be used for API calls to AWS, while Inactive means that the key cannot be used.
      name: status
      predefined:
      - Active
      - Inactive
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow.
    name: aws-iam-update-access-key
  - arguments:
    - description: The name of the user.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Returns information about the access key IDs associated with the specified IAM user.
    name: aws-iam-list-access-keys-for-user
    outputs:
    - contextPath: AWS.IAM.Users.AccessKeys.AccessKeyId
      description: The ID for this access key.
      type: string
    - contextPath: AWS.IAM.Users.AccessKeys.Status
      description: The status of the access key. Active means the key is valid for API calls; Inactive means it is not.
      type: string
    - contextPath: AWS.IAM.Users.AccessKeys.CreateDate
      description: The date when the access key was created.
      type: date
    - contextPath: AWS.IAM.Users.AccessKeys.UserName
      description: The name of the IAM user that the key is associated with.
      type: string
  - arguments:
    - auto: PREDEFINED
      defaultValue: All
      description: The scope to use for filtering the results. To list only AWS managed policies, set Scope to AWS. To list only the customer managed policies in your AWS account, set Scope to Local.
      name: scope
      predefined:
      - All
      - AWS
      - Local
    - auto: PREDEFINED
      defaultValue: 'False'
      description: A flag to filter the results to only the attached policies.  When OnlyAttached is true , the returned list contains only the policies that are attached to an IAM user, group, or role. When OnlyAttached is false , or when the parameter is not included, all policies are returned.
      name: onlyAttached
      predefined:
      - 'True'
      - 'False'
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all the managed policies that are available in your AWS account, including your own customer-defined managed policies and all AWS managed policies.
    name: aws-iam-list-policies
    outputs:
    - contextPath: AWS.IAM.Policies.PolicyName
      description: The friendly name (not ARN) identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policies.PolicyId
      description: The stable and unique string identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policies.Arn
      description: The Amazon Resource Name (ARN).
      type: string
    - contextPath: AWS.IAM.Policies.Path
      description: The path to the policy.
      type: string
    - contextPath: AWS.IAM.Policies.DefaultVersionId
      description: The identifier for the version of the policy that is set as the default version.
      type: string
    - contextPath: AWS.IAM.Policies.IsAttachable
      description: Specifies whether the policy can be attached to an IAM user, group, or role.
      type: string
    - contextPath: AWS.IAM.Policies.CreateDate
      description: when the policy was created.
      type: date
    - contextPath: AWS.IAM.Policies.UpdateDate
      description: when the policy was last updated.
      type: date
    - contextPath: AWS.IAM.Policies.AttachmentCount
      description: The number of entities (users, groups, and roles) that the policy is attached to.
      type: number
  - arguments:
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all IAM roles.
    name: aws-iam-list-roles
    outputs:
    - contextPath: AWS.IAM.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.CreateDate
      description: The date and time when the role was created.
      type: date
    - contextPath: AWS.IAM.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
      type: number
  - arguments:
    - auto: PREDEFINED
      description: The Type of IAM Entity.
      name: type
      predefined:
      - User
      - Group
      - Role
      required: true
    - description: The name (friendly name, not ARN) of the IAM Entity to attach the policy to.
      name: entityName
    - description: The Amazon Resource Name (ARN) of the IAM policy you want to attach.
      name: policyArn
    description: Attaches the specified managed policy to the specified IAM Entity.
    name: aws-iam-attach-policy
  - arguments:
    - auto: PREDEFINED
      description: IAM Entity Type.
      name: type
      predefined:
      - User
      - Group
      - Role
      required: true
    - description: The name (friendly name, not ARN) of the IAM Entity to detach the policy from.
      name: entityName
    - description: The Amazon Resource Name (ARN) of the IAM policy you want to detach.
      name: policyArn
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Removes the specified managed policy from the specified IAM Entity.
    name: aws-iam-detach-policy
  - arguments:
    - description: The name of the user whose password you want to delete.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console.
    name: aws-iam-delete-login-profile
  - arguments:
    - description: The name of the IAM group to delete.
      name: groupName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified IAM group. The group must not contain any users or have any attached policies.
    name: aws-iam-delete-group
  - arguments:
    - description: The name of the user to remove.
      name: userName
      required: true
    - description: The name of the group to update.
      name: groupName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Removes the specified user from the specified group.
    name: aws-iam-remove-user-from-group
  - arguments:
    - description: The name of the IAM user to create a password for. The user must already exist.
      name: userName
      required: true
    - description: The new password for the user.
      name: password
      required: true
    - auto: PREDEFINED
      description: Specifies whether the user is required to set a new password on next sign-in.
      name: passwordResetRequired
      predefined:
      - 'True'
      - 'False'
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console.
    name: aws-iam-create-login-profile
  - arguments:
    - description: The name of the user whose access key pair you want to delete. If username is not provided, the account name configured in your integration will be used.
      name: userName
    - description: The access key ID for the access key ID and secret access key you want to delete.
      name: AccessKeyId
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the access key pair associated with the specified IAM user.
    name: aws-iam-delete-access-key
  - arguments:
    - description: The name of the instance profile to create.
      name: instanceProfileName
      required: true
    - description: The path to the instance profile.
      name: path
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new instance profile.
    name: aws-iam-create-instance-profile
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
  - arguments:
    - description: The name of the instance profile to delete.
      name: instanceProfileName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified instance profile. The instance profile must not have an associated role.
    name: aws-iam-delete-instance-profile
  - arguments:
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all the instance profiles tin your AWS account.
    name: aws-iam-list-instance-profiles
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The name of the instance profile to update.
      name: instanceProfileName
      required: true
    - description: The name of the role to add.
      name: roleName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this limit cannot be increased. You can remove the existing role and then add a different role to an instance profile.
    name: aws-iam-add-role-to-instance-profile
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The name of the instance profile to update.
      name: instanceProfileName
      required: true
    - description: The name of the role to remove.
      name: roleName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Removes the specified IAM role from the specified EC2 instance profile.
    name: aws-iam-remove-role-from-instance-profile
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The name of the role to list instance profiles for.
      name: roleName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists the instance profiles that have the specified associated IAM role.
    name: aws-iam-list-instance-profiles-for-role
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The name of the instance profile to get information about.
      name: instanceProfileName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified instance profile.
    name: aws-iam-get-instance-profile
    outputs:
    - contextPath: AWS.IAM.InstanceProfiles.Path
      description: The path to the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName
      description: The name identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId
      description: The stable and unique string identifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Arn
      description: The Amazon Resource Name (ARN) specifying the instance profile.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.CreateDate
      description: The date when the instance profile was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.InstanceProfiles.Roles. MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The name of the IAM role to get information about.
      name: roleName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified role.
    name: aws-iam-get-role
    outputs:
    - contextPath: AWS.IAM.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument
      description: The policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
    - contextPath: AWS.IAM.Roles.Tags.Key
      description: The tag key.
      type: string
    - contextPath: AWS.IAM.Roles.Tags.Value
      description: The tag value.
      type: string
  - arguments:
    - description: The name of the role to delete.
      name: roleName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified role. The role must not have any policies attached.
    name: aws-iam-delete-role
  - arguments:
    - description: The name of the role to create.
      name: roleName
      required: true
    - description: The trust relationship policy document that grants an entity permission to assume the role.
      name: assumeRolePolicyDocument
      required: true
    - description: The path to the role.
      name: path
    - description: A description of the role.
      name: description
    - description: The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
      name: maxSessionDuration
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new role for your AWS account.
    name: aws-iam-create-role
    outputs:
    - contextPath: AWS.IAM.Roles.RoleName
      description: The friendly name that identifies the role.
      type: string
    - contextPath: AWS.IAM.Roles.RoleId
      description: The stable and unique string identifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.Arn
      description: The Amazon Resource Name (ARN) specifying the role.
      type: string
    - contextPath: AWS.IAM.Roles.CreateDate
      description: The date and time, when the role was created.
      type: date
    - contextPath: AWS.IAM.Roles.Path
      description: The path to the role.
      type: string
    - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument
      description: he policy that grants an entity permission to assume the role.
      type: string
    - contextPath: AWS.IAM.Roles.Description
      description: A description of the role that you provide.
      type: string
    - contextPath: AWS.IAM.Roles.MaxSessionDuration
      description: The maximum session duration (in seconds) for the specified role.
      type: number
  - arguments:
    - description: The friendly name of the policy.
      name: policyName
      required: true
    - description: The JSON policy document that you want to use as the content for the new policy.
      name: policyDocument
      required: true
    - description: The path for the policy.
      name: path
    - description: A friendly description of the policy.
      name: description
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new managed policy for your AWS account.  This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version.
    execution: true
    name: aws-iam-create-policy
    outputs:
    - contextPath: AWS.IAM.Policies.PolicyName
      description: The friendly name (not ARN) identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policies.PolicyId
      description: The stable and unique string identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policies.Arn
      description: The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
      type: string
    - contextPath: AWS.IAM.Policies.Path
      description: The path to the policy.
      type: string
    - contextPath: AWS.IAM.Policies.DefaultVersionId
      description: The identifier for the version of the policy that is set as the default version.
      type: string
    - contextPath: AWS.IAM.Policies.AttachmentCount
      description: The number of entities (users, groups, and roles) that the policy is attached to.
      type: number
    - contextPath: AWS.IAM.Policies.PermissionsBoundaryUsageCount
      description: The number of entities (users and roles) for which the policy is used to set the permissions boundary.
      type: number
    - contextPath: AWS.IAM.Policies.IsAttachable
      description: Specifies whether the policy can be attached to an IAM user, group, or role.
      type: boolean
    - contextPath: AWS.IAM.Policies.Description
      description: A friendly description of the policy.
      type: string
    - contextPath: AWS.IAM.Policies.CreateDate
      description: The date and time, in ISO 8601 date-time format , when the policy was created.
      type: date
    - contextPath: AWS.IAM.Policies.UpdateDate
      description: The date and time, in ISO 8601 date-time format , when the policy was last updated.
      type: date
  - arguments:
    - description: The Amazon Resource Name (ARN) of the IAM policy you want to delete.
      name: policyArn
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified managed policy.  Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to. In addition you must delete all the policy's versions.
    execution: true
    name: aws-iam-delete-policy
  - arguments:
    - description: The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version.
      name: policyArn
      required: true
    - description: The JSON policy document that you want to use as the content for this new version of the policy.
      name: policyDocument
      required: true
    - auto: PREDEFINED
      description: Specifies whether to set this version as the policy's default version.
      name: setAsDefault
      predefined:
      - 'True'
      - 'False'
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version.  Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached.
    execution: true
    name: aws-iam-create-policy-version
    outputs:
    - contextPath: AWS.IAM.Policies.Versions.Document
      description: The policy document.
      type: string
    - contextPath: AWS.IAM.Policies.Versions.VersionId
      description: The identifier for the policy version.
      type: string
    - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion
      description: The identifier for the policy version.
      type: string
    - contextPath: AWS.IAM.Policies.Versions.CreateDate
      description: The date and time, in ISO 8601 date-time format , when the policy version was created.
      type: string
  - arguments:
    - description: The Amazon Resource Name (ARN) of the IAM policy from which you want to delete a version.
      name: policyArn
      required: true
    - description: The policy version to delete.
      name: versionId
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified version from the specified managed policy.  You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy . To find out which version of a policy is marked as the default version, use ListPolicyVersions .
    execution: true
    name: aws-iam-delete-policy-version
  - arguments:
    - description: The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.
      name: policyArn
      required: true
    description: Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.
    name: aws-iam-list-policy-versions
    outputs:
    - contextPath: AWS.IAM.Policies.Versions.Document
      description: The policy document.
      type: string
    - contextPath: AWS.IAM.Policies.Versions.VersionId
      description: The identifier for the policy version.
      type: string
    - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion
      description: Specifies whether the policy version is set as the policy's default version.
      type: boolean
    - contextPath: AWS.IAM.Policies.Versions.CreateDate
      description: The date and time, in ISO 8601 date-time format , when the policy version was created.
      type: date
  - arguments:
    - description: The Amazon Resource Name (ARN) of the managed policy that you want information about.
      name: policyArn
      required: true
    - description: Identifies the policy version to retrieve.
      name: versionId
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified version of the specified managed policy, including the policy document.
    name: aws-iam-get-policy-version
    outputs:
    - contextPath: AWS.IAM.Policies.Versions.Document
      description: The policy document.
      type: Unknown
    - contextPath: AWS.IAM.Policies.Versions.VersionId
      description: The identifier for the policy version.
      type: Unknown
    - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion
      description: Specifies whether the policy version is set as the policy's default version.
      type: Unknown
    - contextPath: AWS.IAM.Policies.Versions.CreateDate
      description: The date and time, in ISO 8601 date-time format , when the policy version was created.
      type: Unknown
  - arguments:
    - description: The Amazon Resource Name (ARN) of the IAM policy whose default version you want to set.
      name: policyArn
      required: true
    - description: The version of the policy to set as the default (operative) version.
      name: versionId
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Sets the specified version of the specified policy as the policy's default (operative) version.  This operation affects all users, groups, and roles that the policy is attached to.
    execution: true
    name: aws-iam-set-default-policy-version
  - arguments:
    - description: The account alias to create.
      name: accountAlias
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates an alias for your AWS account.
    execution: true
    name: aws-iam-create-account-alias
  - arguments:
    - description: The name of the account alias to delete.
      name: accountAlias
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified AWS account alias.
    execution: true
    name: aws-iam-delete-account-alias
  - description: Get AWS account's password policy.
    name: aws-iam-get-account-password-policy
    outputs:
    - contextPath: AWS.IAM.PasswordPolicy
      description: Account's password policy.
      type: Unknown
  - arguments:
    - description: The minimum number of characters allowed in an IAM user password.
      name: minimumPasswordLength
      predefined:
      - ''
    - auto: PREDEFINED
      description: Specifies whether IAM user passwords must contain at least one of the non-alphanumeric characters. Can be "True" or "False".
      name: requireSymbols
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Specifies whether IAM user passwords must contain at least one numeric character (0 to 9). Can be "True" or "False".
      name: requireNumbers
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be "True" or "False".
      name: requireUppercaseCharacters
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be "True" or "False".
      name: requireLowercaseCharacters
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be "True" or "False".
      name: allowUsersToChangePassword
      predefined:
      - 'True'
      - 'False'
    - description: The number of days that an IAM user password is valid.
      name: maxPasswordAge
      predefined:
      - ''
    - description: Specifies the number of previous passwords that IAM users are prevented from reusing.
      name: passwordReusePrevention
      predefined:
      - ''
    - auto: PREDEFINED
      description: Prevents IAM users from setting a new password after their password has expired. Can be "True" or "False".
      name: hardExpiry
      predefined:
      - 'True'
      - 'False'
    description: Create/update password policy.
    execution: true
    name: aws-iam-update-account-password-policy
  - name: aws-iam-account-password-policy-update-quick-action
    description: Updates the password policy to require a minimum length of 14 characters, at least one lowercase letter, one uppercase letter, one symbol. Allows users to reset password, disallow reuse of the last 24 passwords and set password expiration to 90 days. It runs the aws-iam-update-account-password-policy CLI command in your AWS environment and requires the 'iam:UpdateAccountPasswordPolicy' permission.
    prettyname: Apply IAM Password Policy
    hidden: true
    quickaction: true
    arguments:
      - name: account_id
        description: The AWS account ID.
        prettyname: Account ID
        defaultValue: Account ID
        required: true
        prettypredefined:
          Account ID: ${asset.xdm.asset.realm}
      - name: minimumPasswordLength
        description: The minimum number of characters allowed in an IAM user password.
        defaultValue: '14'
        hidden: true
      - name: requireSymbols
        description: Specifies whether IAM user passwords must contain at least one of the non-alphanumeric characters. Can be "True" or "False".
        defaultValue: 'true'
        hidden: true
      - name: requireNumbers
        description: Specifies whether IAM user passwords must contain at least one numeric character (0 to 9). Can be "True" or "False".
        defaultValue: 'true'
        hidden: true
      - name: requireUppercaseCharacters
        description: Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be "True" or "False".
        defaultValue: 'true'
        hidden: true
      - name: requireLowercaseCharacters
        description: Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be "True" or "False".
        defaultValue: 'true'
        hidden: true
      - name: allowUsersToChangePassword
        description: Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be "True" or "False".
        defaultValue: 'true'
        hidden: true
      - name: maxPasswordAge
        description: The number of days that an IAM user password is valid.
        defaultValue: '90'
        hidden: true
      - name: passwordReusePrevention
        description: Specifies the number of previous passwords that IAM users are prevented from reusing.
        defaultValue: '24'
        hidden: true

  - name: aws-iam-login-profile-delete-quick-action
    description: Permanently deletes the IAM user's password (login profile). This prevents the user from signing into the AWS Management Console but does not deactivate their programmatic access keys or delete the IAM user itself.
    prettyname: Remove User Console Access
    hidden: true
    quickaction: true
    arguments:
      - name: account_id
        description: The AWS account ID.
        prettyname: Account ID
        required: true
        defaultValue: Account ID
        prettypredefined:
          Account ID: ${asset.xdm.asset.realm}
      - name: region
        description: The AWS region.
        prettyname: Region
        required: true
        defaultValue: Region
        prettypredefined:
          Region: ${asset.xdm.asset.cloud.region}
      - name: userName
        description: The name of the user whose console access you want to remove.
        prettyname: User Name
        required: true
        defaultValue: User Name
        prettypredefined:
          User Name: ${asset.xdm.asset.name}

  - name: aws-iam-user-policy-put-quick-action
    description: Attaches an inline "Deny All" policy for the specified IAM user, effectively blocking the user from performing any actions on all AWS resources.
    prettyname: Block All User Actions
    hidden: true
    quickaction: true
    arguments:
      - name: account_id
        description: The AWS account ID.
        prettyname: Account ID
        required: true
        defaultValue: Account ID
        prettypredefined:
          Account ID: ${asset.xdm.asset.realm}
      - name: region
        description: The AWS region.
        prettyname: Region
        required: true
        defaultValue: Region
        prettypredefined:
          Region: ${asset.xdm.asset.cloud.region}
      - name: userName
        description: The name of the user to block all actions for.
        prettyname: User Name
        required: true
        defaultValue: User Name
        prettypredefined:
          User Name: ${asset.xdm.asset.name}
      - name: policyName
        description: The name of the deny-all policy document.
        defaultValue: 'DenyAllPolicy'
        hidden: true
      - name: policyDocument
        description: The policy document in JSON format.
        defaultValue: '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}'
        hidden: true

  - name: aws-iam-access-key-update-quick-action
    description: Immediately disables a specific IAM access key. This stops all CLI, SDK, and API-based communication for this key ID without deleting it, enabling forensic recovery or re-enabling if the key is found to be safe.
    prettyname: Deactivate User IAM Access Key
    hidden: true
    quickaction: true
    arguments:
      - name: account_id
        description: The AWS account ID.
        prettyname: Account ID
        required: true
        defaultValue: Account ID
        prettypredefined:
          Account ID: ${asset.xdm.asset.realm}
      - name: region
        description: The AWS region.
        prettyname: Region
        required: true
        defaultValue: Region
        prettypredefined:
          Region: ${asset.xdm.asset.cloud.region}
      - name: accessKeyId
        description: The ID of the access key you want to deactivate.
        prettyname: Access Key ID
        required: true
        defaultValue: Access key ID
        prettypredefined:
          Access Key Id: ${asset.xdm.asset.name}
      - name: status
        description: The status to assign to the access key.
        defaultValue: 'Inactive'
        hidden: true

  - arguments:
    - description: The name of the role to list policies for.
      name: roleName
      required: true
    description: Lists the names of the inline policies that are embedded in the specified IAM role.
    name: aws-iam-list-role-policies
    outputs:
    - contextPath: AWS.IAM.Roles.RoleName.Policies
      description: A list of policy names.
      type: Unknown
  - arguments:
    - description: The name of the role associated with the policy.
      name: roleName
      required: true
    - description: The name of the policy document to get.
      name: policyName
      required: true
    description: Retrieves the specified inline policy document that is embedded with the specified IAM role.
    name: aws-iam-get-role-policy
    outputs:
    - contextPath: AWS.IAM.Roles.PolicyDocument
      description: The policy document.
      type: string
  - arguments:
    - description: The Amazon Resource Name (ARN) of the managed policy that you want information about.
      name: policyArn
      required: true
    description: Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached.
    name: aws-iam-get-policy
    outputs:
    - contextPath: AWS.IAM.Policy.PolicyName
      description: The friendly name (not ARN) identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policy.PolicyId
      description: The stable and unique string identifying the policy.
      type: string
    - contextPath: AWS.IAM.Policy.Arn
      description: The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
      type: string
    - contextPath: AWS.IAM.Policy.Path
      description: The path to the policy.
      type: string
    - contextPath: AWS.IAM.Policy.Description
      description: A friendly description of the policy.
      type: string
  - arguments:
    - description: The name (friendly name, not ARN) of the user to list attached policies for.
      name: userName
      required: true
    - description: Number of results to display.
      defaultValue: '50'
      name: limit
    - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      name: page
    - description: Number of results per page to display.
      name: page_size
    - description: Starting item of the next page to view. Retrieved from a previous run of the command (InlinePoliciesMarker).
      name: marker
    description: Lists the names of the inline policies embedded in the specified IAM user.
    name: aws-iam-list-user-policies
    outputs:
    - contextPath: AWS.IAM.UserPolicies.UserName
      description: The name (friendly name, not ARN) of the user to list attached policies for.
      type: String
    - contextPath: AWS.IAM.UserPolicies.PolicyName
      description: The name of the policy.
      type: String
    - contextPath: AWS.IAM.Users.InlinePoliciesMarker
      description: First element of next page of items.
      type: String
  - arguments:
    - description: The name (friendly name, not ARN) of the user to list attached policies for.
      name: userName
      required: true
    - description: Number of results to display.
      defaultValue: '50'
      name: limit
    - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      name: page
    - description: Number of results per page to display.
      name: page_size
    - description: Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker).
      name: marker
    description: Lists all managed policies that are attached to the specified IAM user.
    name: aws-iam-list-attached-user-policies
    outputs:
    - contextPath: AWS.IAM.AttachedUserPolicies.UserName
      description: The name (friendly name, not ARN) of the user to list attached policies for.
      type: String
    - contextPath: AWS.IAM.AttachedUserPolicies.PolicyName
      description: The name of the attached policy.
      type: String
    - contextPath: AWS.IAM.AttachedUserPolicies.PolicyArn
      description: The Amazon Resource Name (ARN) of the attached policy.
      type: String
    - contextPath: AWS.IAM.Users.AttachedPoliciesMarker
      description: First element of next page of items.
      type: String
  - arguments:
    - description: The name (friendly name, not ARN) of the group to list attached policies for.
      name: groupName
      required: true
    - description: Number of results to display.
      defaultValue: '50'
      name: limit
    - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size.
      name: page
    - description: Number of results per page to display.
      name: page_size
    - description: Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker).
      name: marker
    description: Lists all managed policies that are attached to the specified IAM group.
    name: aws-iam-list-attached-group-policies
    outputs:
    - contextPath: AWS.IAM.AttachedGroupPolicies.GroupName
      description: The name (friendly name, not ARN) of the group to list attached policies for.
      type: String
    - contextPath: AWS.IAM.AttachedGroupPolicies.PolicyName
      description: The name of the attached policy.
      type: String
    - contextPath: AWS.IAM.AttachedGroupPolicies.PolicyArn
      description: The Amazon Resource Name (ARN) of the attached policy.
      type: String
    - contextPath: AWS.IAM.Groups.AttachedPoliciesMarker
      description: First element of next page of items.
      type: String
  - arguments:
    - description: The name (friendly name, not ARN) of the user to list attached policies for.
      name: userName
      required: true
    description: Retrieves the user login profile information for AWS management consle.
    name: aws-iam-get-user-login-profile
    outputs:
    - contextPath: AWS.IAM.Users.LoginProfile.CreateDate
      description: The date when the password for the user was created.
      type: Date
    - contextPath: AWS.IAM.Users.LoginProfile.PasswordResetRequired
      description: Specifies whether the user is required to set a new password on next sign-in.
      type: Boolean
  - arguments:
    - description: The policy document. You must provide policies in JSON format in IAM.
      name: policyDocument
      required: true
    - description: The name of the policy document.
      name: policyName
      required: true
    - description: The name of the role to associate the policy with.
      name: roleName
      required: true
    description: Adds or updates an inline policy document that is embedded in the specified IAM role.
    name: aws-iam-put-role-policy
  - arguments:
    - description: The policy document. You must provide policies in JSON format in IAM.
      name: policyDocument
      required: true
    - description: The name of the policy document.
      name: policyName
      required: true
    - description: The name of the user to associate the policy with.
      name: userName
      required: true
    description: Adds or updates an inline policy document that is embedded in the specified IAM user.
    name: aws-iam-put-user-policy
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: The policy document. You must provide policies in JSON format in IAM.
      name: policyDocument
      required: true
    - description: The name of the policy document.
      name: policyName
      required: true
    - description: The name of the group to associate the policy with.
      name: groupName
      required: true
    description: Adds or updates an inline policy document that is embedded in the specified IAM group.
    name: aws-iam-put-group-policy
  - arguments:
    - description: The name of the IAM role to which you want to add tags.
      name: roleName
      required: true
    - description: A comma-separated list of Key:Value tag objects. I.e., Key1:Value1,Key2:Value2.
      isArray: true
      name: tags
      required: true
    description: Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value.
    name: aws-iam-tag-role
  - arguments:
    - description: The name of the IAM user to which you want to add tags.
      name: userName
      required: true
    - description: A comma-separated list of Key:Value tag objects. I.e., Key1:Value1,Key2:Value2.
      isArray: true
      name: tags
      required: true
    description: Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value.
    name: aws-iam-tag-user
  - arguments:
    - description: The name of the IAM role to which you want to untag.
      name: userName
      required: true
    - description: A comma-separated list of tag keys.
      isArray: true
      name: tagKeys
      required: true
    description: Removes the specified tags from the user.
    name: aws-iam-untag-user
  - arguments:
    - description: The name of the IAM role to which you want to untag.
      name: roleName
      required: true
    - description: A comma-separated list of tag keys.
      isArray: true
      name: tagKeys
      required: true
    description: Removes the specified tags from the role.
    name: aws-iam-untag-role
  - arguments:
    - description: The identifier of an access key.
      name: accessKeyId
      required: true
    description: Retrieves information about when the specified access key was last used. The information includes the date and time of last use, along with the AWS service and region that were specified in the last request made with that key.
    name: aws-iam-get-access-key-last-used
    outputs:
    - contextPath: AWS.IAM.AccessKey.ID
      description: The access key ID.
      type: string
    - contextPath: AWS.IAM.AccessKey.UserName
      description: The username owning the given access key.
      type: string
    - contextPath: AWS.IAM.AccessKey.LastUsedServiceName
      description: The name of the service that last used the given access key.
      type: string
    - contextPath: AWS.IAM.AccessKey.LastUsedRegion
      description: The name of the region where the given access key was last used in.
      type: string
    - contextPath: AWS.IAM.AccessKey.LastUsedDate
      description: The date when the given access key was last used.
      type: string
  - name: aws-iam-list-attached-role-policies
    arguments:
    - description: The name (friendly name, not ARN) of the role to list attached policies for.
      name: roleName
      required: true
    - name: pathPrefix
      description: The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies.
    - name: maxItems
      description: The maximum number of items to return in the command's output.
    - name: marker
      description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
    description: List all managed policies that are attached to the specified IAM role.
    outputs:
    - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.RoleName
      description: The role name.
      type: string
    - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.PolicyName
      description: The policy name.
      type: string
    - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.PolicyArn
      description: The policy ARN.
      type: string
    - contextPath: AWS.IAM.Roles.AttachedPolicies.Query.IsTruncated
      description: Whether there are more items to return. If the results were truncated, make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. AWS recommends checking IsTruncated after every call to ensure that all results are received.
      type: boolean
    - contextPath: AWS.IAM.Roles.AttachedPolicies.Query.Marker
      description: When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
      type: string
  - arguments:
    - description: The name of the user whose MFA devices you want to list.
      name: userName
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
      required: false
    - description: An identifier for the assumed role session.
      name: roleSessionName
      required: false
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
      required: false
    - description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
      name: marker
      required: false
    name: aws-iam-list-mfa-devices
    description: Lists the MFA devices for an IAM user.
    outputs:
    - contextPath: AWS.IAM.MFADevices.Devices.UserName
      description: The user with whom the MFA device is associated.
      type: string
    - contextPath: AWS.IAM.MFADevices.Devices.SerialNumber
      description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.
      type: string
    - contextPath: AWS.IAM.MFADevices.Devices.EnableDate
      description: The date when the MFA device was enabled for the user.
      type: date
    - contextPath: MFADevices.Devices.Marker
      description: First element of next page of items.
      type: string
  - arguments:
    - description: The name of the user whose MFA devices you want to list.
      name: userName
      required: true
    - description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN.
      name: serialNumber
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
      required: false
    - description: An identifier for the assumed role session.
      name: roleSessionName
      required: false
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
      required: false
    description: Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled.
    name: aws-iam-deactivate-mfa-devices
  - arguments:
    - description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN.
      name: serialNumber
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
      required: false
    - description: An identifier for the assumed role session.
      name: roleSessionName
      required: false
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
      required: false
    description: Deletes a virtual MFA device.
    name: aws-iam-delete-mfa-devices
  dockerimage: demisto/boto3py3:1.0.0.10221838
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- AWS - IAM Test Playbook
fromversion: 5.0.0
supportsquickactions: true