AWS - IAM Identity Center

Amazon Web Services Identity and Access Management Identity Center(IAM)

For detailed instructions about setting up authentication, see: AWS Integrations - Authentication.

Configure AWS - IAM Identity Center in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-iam-identitycenter-create-user

Creates a new IAM Identity Center user for your AWS account.

Base Command

aws-iam-identitycenter-create-user

Input

Context Output

Command example

!aws-iam-identitycenter-create-user displayName="John Doe" familyName=Doe givenName=John userName=johndoe userEmailAddress=johnDoe@gmail.com

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "User": {
                "IdentityStoreId": "d-9967750fbd",
                "UserId": "634418e2-20c1-703e-4358-a8312472c85d"
            }
        }
    }
}

Human Readable Output

User johndoe has been successfully created with user id 634418e2-20c1-703e-4358-a8312472c85d

IdentityStoreId	UserId
d-9967750fbd	634418e2-20c1-703e-4358-a8312472c85d

aws-iam-identitycenter-get-user

Retrieves information about the specified IAM user.

Base Command

aws-iam-identitycenter-get-user

Input

Context Output

Command example

!aws-iam-identitycenter-get-user userName=johndoe

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "User": {
                "DisplayName": "John Doe",
                "Emails": [
                    {
                        "Value": "johnDoe@gmail.com"
                    }
                ],
                "IdentityStoreId": "d-9967750fbd",
                "Name": {
                    "FamilyName": "Doe",
                    "GivenName": "John"
                },
                "UserId": "634418e2-20c1-703e-4358-a8312472c85d",
                "UserName": "johndoe"
            }
        }
    }
}

Human Readable Output

AWS IAM Identity Center Users

DisplayName	Emails	UserId	UserName
John Doe	johnDoe@gmail.com	634418e2-20c1-703e-4358-a8312472c85d	johndoe

aws-iam-identitycenter-list-users

Lists the IAM users, returns all users in the AWS account.

Base Command

aws-iam-identitycenter-list-users

Input

Context Output

Command example

#### Context Example

```json
{
    "AWS": {
        "IAMIdentityCenter": {
            "User": [
                {
                    "DisplayName": "John Doe",
                    "Emails": [
                        {
                            "Value": "johnDoe@gmail.com"
                        }
                    ],
                    "IdentityStoreId": "d-9967750fbd",
                    "Name": {
                        "FamilyName": "Doe",
                        "GivenName": "John"
                    },
                    "UserId": "8374c852-10e1-70e2-8996-5b0d54bf8ccd",
                    "UserName": "johndoe"
                },
            ],
            "UserNextToken": null
        }
    }
}

Human Readable Output

AWS IAM Identity Center Users

DisplayName	Emails	UserId	UserName
johndoe	johnDoe@gmail.com	8374c852-10e1-70e2-8996-5b0d54bf8ccd	johndoe

aws-iam-identitycenter-list-groups

Lists all the IAM groups in the AWS account.

Base Command

aws-iam-identitycenter-list-groups

Input

Context Output

Command example

#### Context Example

```json
{
    "AWS": {
        "IAMIdentityCenter": {
            "Group": [
                {
                    "DisplayName": "new",
                    "GroupId": "53142802-e001-7004-9134-9e6e4e1e10c0",
                    "IdentityStoreId": "d-9967750fbd"
                }
            ],
            "GroupNextToken": null
        }
    }
}

Human Readable Output

AWS IAM Identity Center Groups

DisplayName	GroupId
new	53142802-e001-7004-9134-9e6e4e1e10c0

aws-iam-identitycenter-list-groups-for-user

Lists the IAM Identity Center groups that the specified IAM user belongs to.

Base Command

aws-iam-identitycenter-list-groups-for-user

Input

Context Output

Command example

!aws-iam-identitycenter-list-groups-for-user userName=johndoe

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "GroupsUserNextToken":null,
            "User":{
                "GroupMemberships":[
                    {
                        "GroupId":"a3948882-5051-7090-524c-c8c850bf1919",
                        "MembershipId":"e374b872-9011-7000-c847-55fdcc299204",
                    }
                ],
                "UserId":"c3f438a2-e041-7033-75e8-63eb8c64b0e4"
            }
        }
    }
}

Human Readable Output

AWS IAM Identity Center Groups

GroupID	MembershipID	UserID
a3948882-5051-7090-524c-c8c850bf1919	e374b872-9011-7000-c847-55fdcc299204	c3f438a2-e041-7033-75e8-63eb8c64b0e4

aws-iam-identitycenter-add-user-to-group

Adds the specified user to the specified group.

Base Command

aws-iam-identitycenter-add-user-to-group

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-add-user-to-group groupName=NewGroup userName=johndoe

Human Readable Output

The membership id 4314c862-b0c1-705e-d5da-ccf59fd045f3 has been successfully created.

aws-iam-identitycenter-get-group

Get AWS IAM Identity Center group Information.

Base Command

aws-iam-identitycenter-get-group

Input

Context Output

Command example

!aws-iam-identitycenter-get-group displayName=NewGroup

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "Group": {
                "Description": "New",
                "DisplayName": "NewGroup",
                "GroupId": "f3a478d2-50b1-7078-81a4-c97c703007f3",
                "IdentityStoreId": "d-9967750fbd"
            }
        }
    }
}

Human Readable Output

AWS IAM Identity Center Groups

DisplayName	GroupId
NewGroup	f3a478d2-50b1-7078-81a4-c97c703007f3

aws-iam-identitycenter-get-user-by-email

Retrieves information about the specified IAM user.

Base Command

aws-iam-identitycenter-get-user-by-email

Input

Context Output

Command example

!aws-iam-identitycenter-get-user-by-email emailAddress=johnDoe@gmail.com

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "User": {
                "DisplayName": "John Doe",
                "Emails": [
                    {
                        "Primary": true,
                        "Type": "work",
                        "Value": "johnDoe@gmail.com"
                    }
                ],
                "IdentityStoreId": "d-9967750fbd",
                "Name": {
                    "FamilyName": "Doe",
                    "GivenName": "John"
                },
                "UserId": "13746842-e011-70fe-14fe-600d496510f0",
                "UserName": "johndoe",
            }
        }
    }
}

Human Readable Output

AWS IAM Identity Center Users

DisplayName	Emails	UserId	UserName
John Doe	johnDoe@gmail.com	13746842-e011-70fe-14fe-600d496510f0	johndoe

aws-iam-identitycenter-list-memberships

Lists the memberships of the group.

Base Command

aws-iam-identitycenter-list-memberships

Input

Context Output

Command example

!aws-iam-identitycenter-list-memberships groupName=NewGroup

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "Group": {
                "GroupMemberships":[
                    {
                        "MembershipId":"e374b872-9011-7000-c847-55fdcc299204",
                        "UserId":"c3f438a2-e041-7033-75e8-63eb8c64b0e4"
                    }
                ]
            },
            "GroupMembershipNextToken":null
        }
    }
}

Human Readable Output

GroupId	MembershipId	UserId
a3948882-5051-7090-524c-c8c850bf1919	e374b872-9011-7000-c847-55fdcc299204	c3f438a2-e041-7033-75e8-63eb8c64b0e4

aws-iam-identitycenter-delete-user

Removes the specified user from the AWS IAM Identity Center.

Base Command

aws-iam-identitycenter-delete-user

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-delete-user userName=johndoe

Human Readable Output

The User 634418e2-20c1-703e-4358-a8312472c85d has been removed.

aws-iam-identitycenter-delete-group

Removes the specified group from the IAM Identity Center.

Base Command

aws-iam-identitycenter-delete-group

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-delete-group groupName=NewGroup

Human Readable Output

The Group f3a478d2-50b1-7078-81a4-c97c703007f3 has been removed.

aws-iam-identitycenter-create-group

Creates a new IAM Identity Center group for your AWS account.

Base Command

aws-iam-identitycenter-create-group

Input

Context Output

Command example

!aws-iam-identitycenter-create-group description=New displayName=NewGroup

Context Example

{
    "AWS": {
        "IAMIdentityCenter": {
            "Group": {
                "GroupId": "f3a478d2-50b1-7078-81a4-c97c703007f3",
                "IdentityStoreId": "d-9967750fbd"
            }
        }
    }
}

Human Readable Output

Group NewGroup has been successfully created with id f3a478d2-50b1-7078-81a4-c97c703007f3

GroupId	IdentityStoreId
f3a478d2-50b1-7078-81a4-c97c703007f3	d-9967750fbd

aws-iam-identitycenter-update-group

Updates an IAM Identity Center group for your AWS account.

Base Command

aws-iam-identitycenter-update-group

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-update-group description=changed displayName=NewGroup

Human Readable Output

Group NewGroup has been successfully updated

aws-iam-identitycenter-update-user

Updates an IAM Identity Center user for your AWS account.

Base Command

aws-iam-identitycenter-update-user

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-update-user userName=johndoe familyName=changed

Human Readable Output

User johndoe has been successfully updated

aws-iam-identitycenter-delete-group-membership

Deletes a user from all groups if a username is provided, or deletes multiple memberships if a list of memberships is provided.

Base Command

aws-iam-identitycenter-delete-group-membership

Input

Context Output

There is no context output for this command.

Command example

!aws-iam-identitycenter-delete-group-membership userName=johndoe

Human Readable Output

User is not member of any group.