category: IT Services provider: Amazon sectionorder: - Connect - Collect commonfields: id: AWS - IAM version: -1 configuration: - display: Role Arn name: roleArn type: 0 section: Connect required: false - display: Role Session Name name: roleSessionName type: 0 section: Connect required: false - display: AWS Default Region name: defaultRegion options: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - ca-central-1 - eu-west-1 - eu-central-1 - eu-west-2 - ap-northeast-1 - ap-northeast-2 - ap-southeast-1 - ap-southeast-2 - ap-south-1 - sa-east-1 - eu-north-1 - eu-west-3 - us-gov-east-1 - us-gov-west-1 type: 15 section: Connect advanced: true required: true - display: Role Session Duration name: sessionDuration type: 0 section: Connect advanced: true required: false - display: Access Key name: credentials type: 9 displaypassword: Secret Key section: Connect required: false - display: Access Key name: access_key type: 0 hidden: true section: Connect required: false - display: Secret Key name: secret_key type: 4 hidden: true section: Connect required: false - additionalinfo: The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used. defaultvalue: 60,10 display: Timeout name: timeout type: 0 section: Connect advanced: true required: false - additionalinfo: 'The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time.' defaultvalue: '5' display: Retries name: retries type: 0 section: Connect advanced: true required: false - display: AWS STS Regional Endpoints additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration. name: sts_regional_endpoint options: - legacy - regional type: 15 section: Connect required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false description: Amazon Web Services Identity and Access Management (IAM). display: AWS - Identity and Access Management name: AWS - IAM script: commands: - arguments: - description: The name of the user to create. name: userName required: true - description: The path for the user name. This parameter is optional. If it is not included, it defaults to a slash (/). name: path - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new IAM user for your AWS account. name: aws-iam-create-user outputs: - contextPath: AWS.IAM.Users.UserName description: The friendly name identifying the user. type: string - contextPath: AWS.IAM.Users.UserId description: The stable and unique string identifying the user. type: string - contextPath: AWS.IAM.Users.Arn description: The Amazon Resource Name (ARN) that identifies the user. type: string - contextPath: AWS.IAM.Users.CreateDate description: The date and time, when the user was created. type: date - contextPath: AWS.IAM.Users.Path description: The path to the user. type: string - arguments: - description: The name of the user to get information about. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN. name: aws-iam-get-user outputs: - contextPath: AWS.IAM.Users.UserName description: The friendly name identifying the user. type: string - contextPath: AWS.IAM.Users.UserId description: The stable and unique string identifying the user. type: string - contextPath: AWS.IAM.Users.Arn description: The Amazon Resource Name (ARN) that identifies the user. type: string - contextPath: AWS.IAM.Users.CreateDate description: The date and time when the user was created. type: date - contextPath: AWS.IAM.Users.Path description: The path to the user. type: string - contextPath: AWS.IAM.Users.PasswordLastUsed description: The date and time, when the user's password was last used to sign in to an AWS website. type: date - arguments: - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists the IAM users, returns all users in the AWS account. name: aws-iam-list-users outputs: - contextPath: AWS.IAM.Users.UserName description: The friendly name identifying the user. type: string - contextPath: AWS.IAM.Users.UserId description: The stable and unique string identifying the user. type: string - contextPath: AWS.IAM.Users.Arn description: The Amazon Resource Name (ARN) that identifies the user. type: string - contextPath: AWS.IAM.Users.CreateDate description: The date and time when the user was created. type: date - contextPath: AWS.IAM.Users.Path description: The path to the user. type: string - contextPath: AWS.IAM.Users.PasswordLastUsed description: The date and time when the password was last used. type: date - arguments: - description: Name of the user to update. name: oldUserName required: true - description: New name for the user. Include this parameter only if you're changing the user's name. name: newUserName - description: New path for the IAM user. Include this parameter only if you're changing the user's path. name: newPath - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Updates the name and/or the path of the specified IAM user. name: aws-iam-update-user - arguments: - description: The name of the user to delete. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified IAM user. The user must not belong to any groups or have any access keys, signing certificates, or attached policies. name: aws-iam-delete-user - arguments: - description: The name of the user whose password you want to update. name: userName required: true - description: The new password for the specified IAM user. name: newPassword required: false - auto: PREDEFINED description: Requires the specified IAM user to set a new password at the next sign-in. The temporary password can be used only once. name: passwordResetRequired predefined: - 'True' - 'False' required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Changes the password for the specified IAM user. name: aws-iam-update-login-profile - arguments: - description: The name of the group to create. Do not include the path in this value. name: groupName - description: The path to the group. name: path - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new iam group. name: aws-iam-create-group outputs: - contextPath: AWS.IAM.Groups.GroupName description: The friendly name that identifies the group. type: string - contextPath: AWS.IAM.Groups.GroupId description: The stable and unique string identifying the group. type: string - contextPath: AWS.IAM.Groups.Arn description: The Amazon Resource Name (ARN) specifying the group. type: string - contextPath: AWS.IAM.Groups.CreateDate description: The date and time when the group was created. type: date - contextPath: AWS.IAM.Groups.Path description: The path to the group. type: string - arguments: - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists all the IAM groups in the AWS account. name: aws-iam-list-groups outputs: - contextPath: AWS.IAM.Groups.GroupName description: The friendly name that identifies the group. type: string - contextPath: AWS.IAM.Groups.GroupId description: The stable and unique string identifying the group. type: string - contextPath: AWS.IAM.Groups.Arn description: The Amazon Resource Name (ARN) specifying the group. type: string - contextPath: AWS.IAM.Groups.CreateDate description: The date and time when the group was created. type: date - contextPath: AWS.IAM.Groups.Path description: The path to the group. type: string - arguments: - description: The name of the user to list groups for. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists the IAM groups that the specified IAM user belongs to. name: aws-iam-list-groups-for-user outputs: - contextPath: AWS.IAM.Users.Groups.GroupName description: The friendly name that identifies the group. type: string - contextPath: AWS.IAM.Users.Groups.GroupId description: The stable and unique string identifying the group. type: string - contextPath: AWS.IAM.Users.Groups.Arn description: The Amazon Resource Name (ARN) specifying the group. type: string - contextPath: AWS.IAM.Users.Groups.CreateDate description: The date and time when the group was created. type: date - contextPath: AWS.IAM.Users.Groups.Path description: The path to the group. type: string - arguments: - description: The name of the user to add. name: userName required: true - description: The name of the group to update. name: groupName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Adds the specified user to the specified group. name: aws-iam-add-user-to-group - arguments: - description: The name of the IAM user that the new key will belong to. If username is not provided, the account name configured in your integration will be used. name: userName - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is Active . name: aws-iam-create-access-key outputs: - contextPath: AWS.IAM.Users.AccessKeys.AccessKeyId description: The ID for this access key. type: string - contextPath: AWS.IAM.Users.AccessKeys.SecretAccessKey description: The secret key used to sign requests. type: string - contextPath: AWS.IAM.Users.AccessKeys.Status description: The status of the access key. Active means that the key is valid for API calls, while Inactive means it is not. type: string - contextPath: AWS.IAM.Users.AccessKeys.CreateDate description: The date when the access key was created. type: date - arguments: - description: The name of the user whose key you want to update. If username is not provided, the account name configured in your integration will be used. name: userName - description: The access key ID of the secret access key you want to update. name: accessKeyId required: true - auto: PREDEFINED description: The status you want to assign to the secret access key. Active means that the key can be used for API calls to AWS, while Inactive means that the key cannot be used. name: status predefined: - Active - Inactive required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Changes the status of the specified access key from Active to Inactive, or vice versa. This operation can be used to disable a user's key as part of a key rotation workflow. name: aws-iam-update-access-key - arguments: - description: The name of the user. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Returns information about the access key IDs associated with the specified IAM user. name: aws-iam-list-access-keys-for-user outputs: - contextPath: AWS.IAM.Users.AccessKeys.AccessKeyId description: The ID for this access key. type: string - contextPath: AWS.IAM.Users.AccessKeys.Status description: The status of the access key. Active means the key is valid for API calls; Inactive means it is not. type: string - contextPath: AWS.IAM.Users.AccessKeys.CreateDate description: The date when the access key was created. type: date - contextPath: AWS.IAM.Users.AccessKeys.UserName description: The name of the IAM user that the key is associated with. type: string - arguments: - auto: PREDEFINED defaultValue: All description: The scope to use for filtering the results. To list only AWS managed policies, set Scope to AWS. To list only the customer managed policies in your AWS account, set Scope to Local. name: scope predefined: - All - AWS - Local - auto: PREDEFINED defaultValue: 'False' description: A flag to filter the results to only the attached policies. When OnlyAttached is true , the returned list contains only the policies that are attached to an IAM user, group, or role. When OnlyAttached is false , or when the parameter is not included, all policies are returned. name: onlyAttached predefined: - 'True' - 'False' - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists all the managed policies that are available in your AWS account, including your own customer-defined managed policies and all AWS managed policies. name: aws-iam-list-policies outputs: - contextPath: AWS.IAM.Policies.PolicyName description: The friendly name (not ARN) identifying the policy. type: string - contextPath: AWS.IAM.Policies.PolicyId description: The stable and unique string identifying the policy. type: string - contextPath: AWS.IAM.Policies.Arn description: The Amazon Resource Name (ARN). type: string - contextPath: AWS.IAM.Policies.Path description: The path to the policy. type: string - contextPath: AWS.IAM.Policies.DefaultVersionId description: The identifier for the version of the policy that is set as the default version. type: string - contextPath: AWS.IAM.Policies.IsAttachable description: Specifies whether the policy can be attached to an IAM user, group, or role. type: string - contextPath: AWS.IAM.Policies.CreateDate description: when the policy was created. type: date - contextPath: AWS.IAM.Policies.UpdateDate description: when the policy was last updated. type: date - contextPath: AWS.IAM.Policies.AttachmentCount description: The number of entities (users, groups, and roles) that the policy is attached to. type: number - arguments: - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists all IAM roles. name: aws-iam-list-roles outputs: - contextPath: AWS.IAM.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.Roles.CreateDate description: The date and time when the role was created. type: date - contextPath: AWS.IAM.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter. type: number - arguments: - auto: PREDEFINED description: The Type of IAM Entity. name: type predefined: - User - Group - Role required: true - description: The name (friendly name, not ARN) of the IAM Entity to attach the policy to. name: entityName - description: The Amazon Resource Name (ARN) of the IAM policy you want to attach. name: policyArn description: Attaches the specified managed policy to the specified IAM Entity. name: aws-iam-attach-policy - arguments: - auto: PREDEFINED description: IAM Entity Type. name: type predefined: - User - Group - Role required: true - description: The name (friendly name, not ARN) of the IAM Entity to detach the policy from. name: entityName - description: The Amazon Resource Name (ARN) of the IAM policy you want to detach. name: policyArn - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Removes the specified managed policy from the specified IAM Entity. name: aws-iam-detach-policy - arguments: - description: The name of the user whose password you want to delete. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the password for the specified IAM user, which terminates the user's ability to access AWS services through the AWS Management Console. name: aws-iam-delete-login-profile - arguments: - description: The name of the IAM group to delete. name: groupName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified IAM group. The group must not contain any users or have any attached policies. name: aws-iam-delete-group - arguments: - description: The name of the user to remove. name: userName required: true - description: The name of the group to update. name: groupName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Removes the specified user from the specified group. name: aws-iam-remove-user-from-group - arguments: - description: The name of the IAM user to create a password for. The user must already exist. name: userName required: true - description: The new password for the user. name: password required: true - auto: PREDEFINED description: Specifies whether the user is required to set a new password on next sign-in. name: passwordResetRequired predefined: - 'True' - 'False' - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console. name: aws-iam-create-login-profile - arguments: - description: The name of the user whose access key pair you want to delete. If username is not provided, the account name configured in your integration will be used. name: userName - description: The access key ID for the access key ID and secret access key you want to delete. name: AccessKeyId required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the access key pair associated with the specified IAM user. name: aws-iam-delete-access-key - arguments: - description: The name of the instance profile to create. name: instanceProfileName required: true - description: The path to the instance profile. name: path - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new instance profile. name: aws-iam-create-instance-profile outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - arguments: - description: The name of the instance profile to delete. name: instanceProfileName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified instance profile. The instance profile must not have an associated role. name: aws-iam-delete-instance-profile - arguments: - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists all the instance profiles tin your AWS account. name: aws-iam-list-instance-profiles outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The name of the instance profile to update. name: instanceProfileName required: true - description: The name of the role to add. name: roleName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this limit cannot be increased. You can remove the existing role and then add a different role to an instance profile. name: aws-iam-add-role-to-instance-profile outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The name of the instance profile to update. name: instanceProfileName required: true - description: The name of the role to remove. name: roleName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Removes the specified IAM role from the specified EC2 instance profile. name: aws-iam-remove-role-from-instance-profile outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The name of the role to list instance profiles for. name: roleName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Lists the instance profiles that have the specified associated IAM role. name: aws-iam-list-instance-profiles-for-role outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The name of the instance profile to get information about. name: instanceProfileName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Retrieves information about the specified instance profile. name: aws-iam-get-instance-profile outputs: - contextPath: AWS.IAM.InstanceProfiles.Path description: The path to the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileName description: The name identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.InstanceProfileId description: The stable and unique string identifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.Arn description: The Amazon Resource Name (ARN) specifying the instance profile. type: string - contextPath: AWS.IAM.InstanceProfiles.CreateDate description: The date when the instance profile was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.InstanceProfiles.Roles. MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The name of the IAM role to get information about. name: roleName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Retrieves information about the specified role. name: aws-iam-get-role outputs: - contextPath: AWS.IAM.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument description: The policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - contextPath: AWS.IAM.Roles.Tags.Key description: The tag key. type: string - contextPath: AWS.IAM.Roles.Tags.Value description: The tag value. type: string - arguments: - description: The name of the role to delete. name: roleName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified role. The role must not have any policies attached. name: aws-iam-delete-role - arguments: - description: The name of the role to create. name: roleName required: true - description: The trust relationship policy document that grants an entity permission to assume the role. name: assumeRolePolicyDocument required: true - description: The path to the role. name: path - description: A description of the role. name: description - description: The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours. name: maxSessionDuration - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new role for your AWS account. name: aws-iam-create-role outputs: - contextPath: AWS.IAM.Roles.RoleName description: The friendly name that identifies the role. type: string - contextPath: AWS.IAM.Roles.RoleId description: The stable and unique string identifying the role. type: string - contextPath: AWS.IAM.Roles.Arn description: The Amazon Resource Name (ARN) specifying the role. type: string - contextPath: AWS.IAM.Roles.CreateDate description: The date and time, when the role was created. type: date - contextPath: AWS.IAM.Roles.Path description: The path to the role. type: string - contextPath: AWS.IAM.Roles.AssumeRolePolicyDocument description: he policy that grants an entity permission to assume the role. type: string - contextPath: AWS.IAM.Roles.Description description: A description of the role that you provide. type: string - contextPath: AWS.IAM.Roles.MaxSessionDuration description: The maximum session duration (in seconds) for the specified role. type: number - arguments: - description: The friendly name of the policy. name: policyName required: true - description: The JSON policy document that you want to use as the content for the new policy. name: policyDocument required: true - description: The path for the policy. name: path - description: A friendly description of the policy. name: description - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new managed policy for your AWS account. This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version. execution: true name: aws-iam-create-policy outputs: - contextPath: AWS.IAM.Policies.PolicyName description: The friendly name (not ARN) identifying the policy. type: string - contextPath: AWS.IAM.Policies.PolicyId description: The stable and unique string identifying the policy. type: string - contextPath: AWS.IAM.Policies.Arn description: The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources. type: string - contextPath: AWS.IAM.Policies.Path description: The path to the policy. type: string - contextPath: AWS.IAM.Policies.DefaultVersionId description: The identifier for the version of the policy that is set as the default version. type: string - contextPath: AWS.IAM.Policies.AttachmentCount description: The number of entities (users, groups, and roles) that the policy is attached to. type: number - contextPath: AWS.IAM.Policies.PermissionsBoundaryUsageCount description: The number of entities (users and roles) for which the policy is used to set the permissions boundary. type: number - contextPath: AWS.IAM.Policies.IsAttachable description: Specifies whether the policy can be attached to an IAM user, group, or role. type: boolean - contextPath: AWS.IAM.Policies.Description description: A friendly description of the policy. type: string - contextPath: AWS.IAM.Policies.CreateDate description: The date and time, in ISO 8601 date-time format , when the policy was created. type: date - contextPath: AWS.IAM.Policies.UpdateDate description: The date and time, in ISO 8601 date-time format , when the policy was last updated. type: date - arguments: - description: The Amazon Resource Name (ARN) of the IAM policy you want to delete. name: policyArn required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified managed policy. Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to. In addition you must delete all the policy's versions. execution: true name: aws-iam-delete-policy - arguments: - description: The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version. name: policyArn required: true - description: The JSON policy document that you want to use as the content for this new version of the policy. name: policyDocument required: true - auto: PREDEFINED description: Specifies whether to set this version as the policy's default version. name: setAsDefault predefined: - 'True' - 'False' - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version. Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached. execution: true name: aws-iam-create-policy-version outputs: - contextPath: AWS.IAM.Policies.Versions.Document description: The policy document. type: string - contextPath: AWS.IAM.Policies.Versions.VersionId description: The identifier for the policy version. type: string - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion description: The identifier for the policy version. type: string - contextPath: AWS.IAM.Policies.Versions.CreateDate description: The date and time, in ISO 8601 date-time format , when the policy version was created. type: string - arguments: - description: The Amazon Resource Name (ARN) of the IAM policy from which you want to delete a version. name: policyArn required: true - description: The policy version to delete. name: versionId required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified version from the specified managed policy. You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy . To find out which version of a policy is marked as the default version, use ListPolicyVersions . execution: true name: aws-iam-delete-policy-version - arguments: - description: The Amazon Resource Name (ARN) of the IAM policy for which you want the versions. name: policyArn required: true description: Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version. name: aws-iam-list-policy-versions outputs: - contextPath: AWS.IAM.Policies.Versions.Document description: The policy document. type: string - contextPath: AWS.IAM.Policies.Versions.VersionId description: The identifier for the policy version. type: string - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion description: Specifies whether the policy version is set as the policy's default version. type: boolean - contextPath: AWS.IAM.Policies.Versions.CreateDate description: The date and time, in ISO 8601 date-time format , when the policy version was created. type: date - arguments: - description: The Amazon Resource Name (ARN) of the managed policy that you want information about. name: policyArn required: true - description: Identifies the policy version to retrieve. name: versionId required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Retrieves information about the specified version of the specified managed policy, including the policy document. name: aws-iam-get-policy-version outputs: - contextPath: AWS.IAM.Policies.Versions.Document description: The policy document. type: Unknown - contextPath: AWS.IAM.Policies.Versions.VersionId description: The identifier for the policy version. type: Unknown - contextPath: AWS.IAM.Policies.Versions.IsDefaultVersion description: Specifies whether the policy version is set as the policy's default version. type: Unknown - contextPath: AWS.IAM.Policies.Versions.CreateDate description: The date and time, in ISO 8601 date-time format , when the policy version was created. type: Unknown - arguments: - description: The Amazon Resource Name (ARN) of the IAM policy whose default version you want to set. name: policyArn required: true - description: The version of the policy to set as the default (operative) version. name: versionId required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Sets the specified version of the specified policy as the policy's default (operative) version. This operation affects all users, groups, and roles that the policy is attached to. execution: true name: aws-iam-set-default-policy-version - arguments: - description: The account alias to create. name: accountAlias required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Creates an alias for your AWS account. execution: true name: aws-iam-create-account-alias - arguments: - description: The name of the account alias to delete. name: accountAlias required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn - description: An identifier for the assumed role session. name: roleSessionName - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration description: Deletes the specified AWS account alias. execution: true name: aws-iam-delete-account-alias - description: Get AWS account's password policy. name: aws-iam-get-account-password-policy outputs: - contextPath: AWS.IAM.PasswordPolicy description: Account's password policy. type: Unknown - arguments: - description: The minimum number of characters allowed in an IAM user password. name: minimumPasswordLength predefined: - '' - auto: PREDEFINED description: Specifies whether IAM user passwords must contain at least one of the non-alphanumeric characters. Can be "True" or "False". name: requireSymbols predefined: - 'True' - 'False' - auto: PREDEFINED description: Specifies whether IAM user passwords must contain at least one numeric character (0 to 9). Can be "True" or "False". name: requireNumbers predefined: - 'True' - 'False' - auto: PREDEFINED description: Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be "True" or "False". name: requireUppercaseCharacters predefined: - 'True' - 'False' - auto: PREDEFINED description: Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be "True" or "False". name: requireLowercaseCharacters predefined: - 'True' - 'False' - auto: PREDEFINED description: Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be "True" or "False". name: allowUsersToChangePassword predefined: - 'True' - 'False' - description: The number of days that an IAM user password is valid. name: maxPasswordAge predefined: - '' - description: Specifies the number of previous passwords that IAM users are prevented from reusing. name: passwordReusePrevention predefined: - '' - auto: PREDEFINED description: Prevents IAM users from setting a new password after their password has expired. Can be "True" or "False". name: hardExpiry predefined: - 'True' - 'False' description: Create/update password policy. execution: true name: aws-iam-update-account-password-policy - name: aws-iam-account-password-policy-update-quick-action description: Updates the password policy to require a minimum length of 14 characters, at least one lowercase letter, one uppercase letter, one symbol. Allows users to reset password, disallow reuse of the last 24 passwords and set password expiration to 90 days. It runs the aws-iam-update-account-password-policy CLI command in your AWS environment and requires the 'iam:UpdateAccountPasswordPolicy' permission. prettyname: Apply IAM Password Policy hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID defaultValue: Account ID required: true prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: minimumPasswordLength description: The minimum number of characters allowed in an IAM user password. defaultValue: '14' hidden: true - name: requireSymbols description: Specifies whether IAM user passwords must contain at least one of the non-alphanumeric characters. Can be "True" or "False". defaultValue: 'true' hidden: true - name: requireNumbers description: Specifies whether IAM user passwords must contain at least one numeric character (0 to 9). Can be "True" or "False". defaultValue: 'true' hidden: true - name: requireUppercaseCharacters description: Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z). Can be "True" or "False". defaultValue: 'true' hidden: true - name: requireLowercaseCharacters description: Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z). Can be "True" or "False". defaultValue: 'true' hidden: true - name: allowUsersToChangePassword description: Allows all IAM users in your account to use the AWS Management Console to change their own passwords. Can be "True" or "False". defaultValue: 'true' hidden: true - name: maxPasswordAge description: The number of days that an IAM user password is valid. defaultValue: '90' hidden: true - name: passwordReusePrevention description: Specifies the number of previous passwords that IAM users are prevented from reusing. defaultValue: '24' hidden: true - name: aws-iam-login-profile-delete-quick-action description: Permanently deletes the IAM user's password (login profile). This prevents the user from signing into the AWS Management Console but does not deactivate their programmatic access keys or delete the IAM user itself. prettyname: Remove User Console Access hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: userName description: The name of the user whose console access you want to remove. prettyname: User Name required: true defaultValue: User Name prettypredefined: User Name: ${asset.xdm.asset.name} - name: aws-iam-user-policy-put-quick-action description: Attaches an inline "Deny All" policy for the specified IAM user, effectively blocking the user from performing any actions on all AWS resources. prettyname: Block All User Actions hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: userName description: The name of the user to block all actions for. prettyname: User Name required: true defaultValue: User Name prettypredefined: User Name: ${asset.xdm.asset.name} - name: policyName description: The name of the deny-all policy document. defaultValue: 'DenyAllPolicy' hidden: true - name: policyDocument description: The policy document in JSON format. defaultValue: '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}' hidden: true - name: aws-iam-access-key-update-quick-action description: Immediately disables a specific IAM access key. This stops all CLI, SDK, and API-based communication for this key ID without deleting it, enabling forensic recovery or re-enabling if the key is found to be safe. prettyname: Deactivate User IAM Access Key hidden: true quickaction: true arguments: - name: account_id description: The AWS account ID. prettyname: Account ID required: true defaultValue: Account ID prettypredefined: Account ID: ${asset.xdm.asset.realm} - name: region description: The AWS region. prettyname: Region required: true defaultValue: Region prettypredefined: Region: ${asset.xdm.asset.cloud.region} - name: accessKeyId description: The ID of the access key you want to deactivate. prettyname: Access Key ID required: true defaultValue: Access key ID prettypredefined: Access Key Id: ${asset.xdm.asset.name} - name: status description: The status to assign to the access key. defaultValue: 'Inactive' hidden: true - arguments: - description: The name of the role to list policies for. name: roleName required: true description: Lists the names of the inline policies that are embedded in the specified IAM role. name: aws-iam-list-role-policies outputs: - contextPath: AWS.IAM.Roles.RoleName.Policies description: A list of policy names. type: Unknown - arguments: - description: The name of the role associated with the policy. name: roleName required: true - description: The name of the policy document to get. name: policyName required: true description: Retrieves the specified inline policy document that is embedded with the specified IAM role. name: aws-iam-get-role-policy outputs: - contextPath: AWS.IAM.Roles.PolicyDocument description: The policy document. type: string - arguments: - description: The Amazon Resource Name (ARN) of the managed policy that you want information about. name: policyArn required: true description: Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached. name: aws-iam-get-policy outputs: - contextPath: AWS.IAM.Policy.PolicyName description: The friendly name (not ARN) identifying the policy. type: string - contextPath: AWS.IAM.Policy.PolicyId description: The stable and unique string identifying the policy. type: string - contextPath: AWS.IAM.Policy.Arn description: The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources. type: string - contextPath: AWS.IAM.Policy.Path description: The path to the policy. type: string - contextPath: AWS.IAM.Policy.Description description: A friendly description of the policy. type: string - arguments: - description: The name (friendly name, not ARN) of the user to list attached policies for. name: userName required: true - description: Number of results to display. defaultValue: '50' name: limit - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size. name: page - description: Number of results per page to display. name: page_size - description: Starting item of the next page to view. Retrieved from a previous run of the command (InlinePoliciesMarker). name: marker description: Lists the names of the inline policies embedded in the specified IAM user. name: aws-iam-list-user-policies outputs: - contextPath: AWS.IAM.UserPolicies.UserName description: The name (friendly name, not ARN) of the user to list attached policies for. type: String - contextPath: AWS.IAM.UserPolicies.PolicyName description: The name of the policy. type: String - contextPath: AWS.IAM.Users.InlinePoliciesMarker description: First element of next page of items. type: String - arguments: - description: The name (friendly name, not ARN) of the user to list attached policies for. name: userName required: true - description: Number of results to display. defaultValue: '50' name: limit - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size. name: page - description: Number of results per page to display. name: page_size - description: Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker). name: marker description: Lists all managed policies that are attached to the specified IAM user. name: aws-iam-list-attached-user-policies outputs: - contextPath: AWS.IAM.AttachedUserPolicies.UserName description: The name (friendly name, not ARN) of the user to list attached policies for. type: String - contextPath: AWS.IAM.AttachedUserPolicies.PolicyName description: The name of the attached policy. type: String - contextPath: AWS.IAM.AttachedUserPolicies.PolicyArn description: The Amazon Resource Name (ARN) of the attached policy. type: String - contextPath: AWS.IAM.Users.AttachedPoliciesMarker description: First element of next page of items. type: String - arguments: - description: The name (friendly name, not ARN) of the group to list attached policies for. name: groupName required: true - description: Number of results to display. defaultValue: '50' name: limit - description: Page number you would like to view. Each page contains page_size values. Must be used along with page_size. name: page - description: Number of results per page to display. name: page_size - description: Starting item of the next page to view. Can be retrieved from context (AttachedPoliciesMarker). name: marker description: Lists all managed policies that are attached to the specified IAM group. name: aws-iam-list-attached-group-policies outputs: - contextPath: AWS.IAM.AttachedGroupPolicies.GroupName description: The name (friendly name, not ARN) of the group to list attached policies for. type: String - contextPath: AWS.IAM.AttachedGroupPolicies.PolicyName description: The name of the attached policy. type: String - contextPath: AWS.IAM.AttachedGroupPolicies.PolicyArn description: The Amazon Resource Name (ARN) of the attached policy. type: String - contextPath: AWS.IAM.Groups.AttachedPoliciesMarker description: First element of next page of items. type: String - arguments: - description: The name (friendly name, not ARN) of the user to list attached policies for. name: userName required: true description: Retrieves the user login profile information for AWS management consle. name: aws-iam-get-user-login-profile outputs: - contextPath: AWS.IAM.Users.LoginProfile.CreateDate description: The date when the password for the user was created. type: Date - contextPath: AWS.IAM.Users.LoginProfile.PasswordResetRequired description: Specifies whether the user is required to set a new password on next sign-in. type: Boolean - arguments: - description: The policy document. You must provide policies in JSON format in IAM. name: policyDocument required: true - description: The name of the policy document. name: policyName required: true - description: The name of the role to associate the policy with. name: roleName required: true description: Adds or updates an inline policy document that is embedded in the specified IAM role. name: aws-iam-put-role-policy - arguments: - description: The policy document. You must provide policies in JSON format in IAM. name: policyDocument required: true - description: The name of the policy document. name: policyName required: true - description: The name of the user to associate the policy with. name: userName required: true description: Adds or updates an inline policy document that is embedded in the specified IAM user. name: aws-iam-put-user-policy compliantpolicies: - User Hard Remediation - arguments: - description: The policy document. You must provide policies in JSON format in IAM. name: policyDocument required: true - description: The name of the policy document. name: policyName required: true - description: The name of the group to associate the policy with. name: groupName required: true description: Adds or updates an inline policy document that is embedded in the specified IAM group. name: aws-iam-put-group-policy - arguments: - description: The name of the IAM role to which you want to add tags. name: roleName required: true - description: A comma-separated list of Key:Value tag objects. I.e., Key1:Value1,Key2:Value2. isArray: true name: tags required: true description: Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value. name: aws-iam-tag-role - arguments: - description: The name of the IAM user to which you want to add tags. name: userName required: true - description: A comma-separated list of Key:Value tag objects. I.e., Key1:Value1,Key2:Value2. isArray: true name: tags required: true description: Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value. name: aws-iam-tag-user - arguments: - description: The name of the IAM role to which you want to untag. name: userName required: true - description: A comma-separated list of tag keys. isArray: true name: tagKeys required: true description: Removes the specified tags from the user. name: aws-iam-untag-user - arguments: - description: The name of the IAM role to which you want to untag. name: roleName required: true - description: A comma-separated list of tag keys. isArray: true name: tagKeys required: true description: Removes the specified tags from the role. name: aws-iam-untag-role - arguments: - description: The identifier of an access key. name: accessKeyId required: true description: Retrieves information about when the specified access key was last used. The information includes the date and time of last use, along with the AWS service and region that were specified in the last request made with that key. name: aws-iam-get-access-key-last-used outputs: - contextPath: AWS.IAM.AccessKey.ID description: The access key ID. type: string - contextPath: AWS.IAM.AccessKey.UserName description: The username owning the given access key. type: string - contextPath: AWS.IAM.AccessKey.LastUsedServiceName description: The name of the service that last used the given access key. type: string - contextPath: AWS.IAM.AccessKey.LastUsedRegion description: The name of the region where the given access key was last used in. type: string - contextPath: AWS.IAM.AccessKey.LastUsedDate description: The date when the given access key was last used. type: string - name: aws-iam-list-attached-role-policies arguments: - description: The name (friendly name, not ARN) of the role to list attached policies for. name: roleName required: true - name: pathPrefix description: The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies. - name: maxItems description: The maximum number of items to return in the command's output. - name: marker description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start. description: List all managed policies that are attached to the specified IAM role. outputs: - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.RoleName description: The role name. type: string - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.PolicyName description: The policy name. type: string - contextPath: AWS.IAM.Roles.AttachedPolicies.Policies.PolicyArn description: The policy ARN. type: string - contextPath: AWS.IAM.Roles.AttachedPolicies.Query.IsTruncated description: Whether there are more items to return. If the results were truncated, make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. AWS recommends checking IsTruncated after every call to ensure that all results are received. type: boolean - contextPath: AWS.IAM.Roles.AttachedPolicies.Query.Marker description: When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request. type: string - arguments: - description: The name of the user whose MFA devices you want to list. name: userName required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn required: false - description: An identifier for the assumed role session. name: roleSessionName required: false - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration required: false - description: Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start. name: marker required: false name: aws-iam-list-mfa-devices description: Lists the MFA devices for an IAM user. outputs: - contextPath: AWS.IAM.MFADevices.Devices.UserName description: The user with whom the MFA device is associated. type: string - contextPath: AWS.IAM.MFADevices.Devices.SerialNumber description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN. type: string - contextPath: AWS.IAM.MFADevices.Devices.EnableDate description: The date when the MFA device was enabled for the user. type: date - contextPath: MFADevices.Devices.Marker description: First element of next page of items. type: string - arguments: - description: The name of the user whose MFA devices you want to list. name: userName required: true - description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN. name: serialNumber required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn required: false - description: An identifier for the assumed role session. name: roleSessionName required: false - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration required: false description: Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled. name: aws-iam-deactivate-mfa-devices - arguments: - description: The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN. name: serialNumber required: true - description: The Amazon Resource Name (ARN) of the role to assume. name: roleArn required: false - description: An identifier for the assumed role session. name: roleSessionName required: false - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. name: roleSessionDuration required: false description: Deletes a virtual MFA device. name: aws-iam-delete-mfa-devices dockerimage: demisto/boto3py3:1.0.0.10221838 runonce: false script: '-' subtype: python3 type: python tests: - AWS - IAM Test Playbook fromversion: 5.0.0 supportsquickactions: true