2018/07/12 - AWS Identity and Access Management - 4 new 20 updated api methods
Changes SDK release to support IAM delegated administrator feature. The feature lets customers attach permissions boundary to IAM principals. The IAM principals cannot operate exceeding the permission specified in permissions boundary.
Deletes the permissions boundary for the specified IAM role.
Warning
Deleting the permissions boundary for a role might increase its permissions by allowing anyone who assumes the role to perform all the actions granted in its permissions policies.
See also: AWS API Documentation
Request Syntax
client.delete_role_permissions_boundary(
RoleName='string'
)
string
[REQUIRED]
The name (friendly name, not ARN) of the IAM role from which you want to remove the permissions boundary.
None
Deletes the permissions boundary for the specified IAM user.
Warning
Deleting the permissions boundary for a user might increase its permissions by allowing the user to perform all the actions granted in its permissions policies.
See also: AWS API Documentation
Request Syntax
client.delete_user_permissions_boundary(
UserName='string'
)
string
[REQUIRED]
The name (friendly name, not ARN) of the IAM user from which you want to remove the permissions boundary.
None
Adds or updates the policy that is specified as the IAM user's permissions boundary. You can use an AWS managed policy or a customer managed policy to set the boundary for a user. Use the boundary to control the maximum permissions that the user can have. Setting a permissions boundary is an advanced feature that can affect the permissions for the user.
Warning
Policies that are used as permissions boundaries do not provide permissions. You must also attach a permissions policy to the user. To learn how the effective permissions for a user are evaluated, see IAM JSON Policy Evaluation Logic in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.put_user_permissions_boundary(
UserName='string',
PermissionsBoundary='string'
)
string
[REQUIRED]
The name (friendly name, not ARN) of the IAM user for which you want to set the permissions boundary.
string
[REQUIRED]
The ARN of the policy that is used to set the permissions boundary for the user.
None
Adds or updates the policy that is specified as the IAM role's permissions boundary. You can use an AWS managed policy or a customer managed policy to set the boundary for a role. Use the boundary to control the maximum permissions that the role can have. Setting a permissions boundary is an advanced feature that can affect the permissions for the role.
You cannot set the boundary for a service-linked role.
Warning
Policies used as permissions boundaries do not provide permissions. You must also attach a permissions policy to the role. To learn how the effective permissions for a role are evaluated, see IAM JSON Policy Evaluation Logic in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.put_role_permissions_boundary(
RoleName='string',
PermissionsBoundary='string'
)
string
[REQUIRED]
The name (friendly name, not ARN) of the IAM role for which you want to set the permissions boundary.
string
[REQUIRED]
The ARN of the policy that is used to set the permissions boundary for the role.
None
{'InstanceProfile': {'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Creates a new instance profile. For information about instance profiles, go to About Instance Profiles .
For information about the number of instance profiles you can create, see Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_instance_profile(
InstanceProfileName='string',
Path='string'
)
string
[REQUIRED]
The name of the instance profile to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful CreateInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the new instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Policy': {'PermissionsBoundaryUsageCount': 'integer'}}
Creates a new managed policy for your AWS account.
This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version. For more information about policy versions, see Versioning for Managed Policies in the IAM User Guide .
For more information about managed policies in general, see Managed Policies and Inline Policies in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_policy(
PolicyName='string',
Path='string',
PolicyDocument='string',
Description='string'
)
string
[REQUIRED]
The friendly name of the policy.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
The path for the policy.
For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The JSON policy document that you want to use as the content for the new policy.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
Any printable ASCII character ranging from the space character (u0020) through the end of the ASCII character range
The printable characters in the Basic Latin and Latin-1 Supplement character set (through u00FF)
The special characters tab (u0009), line feed (u000A), and carriage return (u000D)
string
A friendly description of the policy.
Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables."
The policy description is immutable. After a value is assigned, it cannot be changed.
dict
Response Syntax
{
'Policy': {
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Contains the response to a successful CreatePolicy request.
Policy (dict) --
A structure containing details about the new policy.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Path (string) --
The path to the policy.
For more information about paths, see IAM Identifiers in the Using IAM guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default version.
AttachmentCount (integer) --
The number of entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used to set the permissions boundary.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
This element is included in the response to the GetPolicy operation. It is not included in the response to the ListPolicies operation.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
{'PermissionsBoundary': 'string'}
Response {'Role': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Creates a new role for your AWS account. For more information about roles, go to IAM Roles . For information about limitations on role names and the number of roles you can create, go to Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_role(
Path='string',
RoleName='string',
AssumeRolePolicyDocument='string',
Description='string',
MaxSessionDuration=123,
PermissionsBoundary='string'
)
string
The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the role to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
Role names are not distinguished by case. For example, you cannot create roles named both "PRODROLE" and "prodrole".
string
[REQUIRED]
The trust relationship policy document that grants an entity permission to assume the role.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
Any printable ASCII character ranging from the space character (u0020) through the end of the ASCII character range
The printable characters in the Basic Latin and Latin-1 Supplement character set (through u00FF)
The special characters tab (u0009), line feed (u000A), and carriage return (u000D)
string
A description of the role.
integer
The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
Anyone who assumes the role from the AWS CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM Roles in the IAM User Guide .
string
The ARN of the policy that is used to set the permissions boundary for the role.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful CreateRole request.
Role (dict) --
A structure containing details about the new role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Role': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Creates an IAM role that is linked to a specific AWS service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed.
The name of the role is generated by combining the string that you specify for the AWSServiceName parameter with the string that you specify for the CustomSuffix parameter. The resulting name must be unique in your account or the request fails.
To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.
See also: AWS API Documentation
Request Syntax
client.create_service_linked_role(
AWSServiceName='string',
Description='string',
CustomSuffix='string'
)
string
[REQUIRED]
The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com
string
The description of the role.
string
A string that you provide, which is combined with the service name to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Role (dict) --
A Role object that contains details about the newly created role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'PermissionsBoundary': 'string'}
Response {'User': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Creates a new IAM user for your AWS account.
For information about limitations on the number of IAM users you can create, see Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_user(
Path='string',
UserName='string',
PermissionsBoundary='string'
)
string
The path for the user name. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the user to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
string
The ARN of the policy that is used to set the permissions boundary for the user.
dict
Response Syntax
{
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful CreateUser request.
User (dict) --
A structure with details about the new IAM user.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'VirtualMFADevice': {'User': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Creates a new virtual MFA device for the AWS account. After creating the virtual MFA, use EnableMFADevice to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, go to Using a Virtual MFA Device in the IAM User Guide .
For information about limits on the number of MFA devices you can create, see Limitations on Entities in the IAM User Guide .
Warning
The seed information contained in the QR code and the Base32 string should be treated like any other secret access information, such as your AWS access keys or your passwords. After you provision your virtual device, you should ensure that the information is destroyed following secure procedures.
See also: AWS API Documentation
Request Syntax
client.create_virtual_mfa_device(
Path='string',
VirtualMFADeviceName='string'
)
string
The path for the virtual MFA device. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'VirtualMFADevice': {
'SerialNumber': 'string',
'Base32StringSeed': b'bytes',
'QRCodePNG': b'bytes',
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
'EnableDate': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Contains the response to a successful CreateVirtualMFADevice request.
VirtualMFADevice (dict) --
A structure containing details about the new virtual MFA device.
SerialNumber (string) --
The serial number associated with VirtualMFADevice .
Base32StringSeed (bytes) --
The Base32 seed defined as specified in RFC3548 . The Base32StringSeed is Base64-encoded.
QRCodePNG (bytes) --
A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
User (dict) --
The IAM user associated with this virtual MFA device.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
EnableDate (datetime) --
The date and time on which the virtual MFA device was enabled.
{'Policies': {'PermissionsBoundaryUsageCount': 'integer'},
'RoleDetailList': {'InstanceProfileList': {'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}},
'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}},
'UserDetailList': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Retrieves information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another. Use this API to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account.
Note
Policies returned by this API are URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.get_account_authorization_details(
Filter=[
'User'|'Role'|'Group'|'LocalManagedPolicy'|'AWSManagedPolicy',
],
MaxItems=123,
Marker='string'
)
list
A list of entity types used to filter the results. Only the entities that match the types you specify are included in the output. Use the value LocalManagedPolicy to include customer managed policies.
The format for this parameter is a comma-separated (if more than one) list of strings. Each string value in the list must be one of the valid values listed below.
(string) --
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
dict
Response Syntax
{
'UserDetailList': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'UserPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'GroupList': [
'string',
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'GroupDetailList': [
{
'Path': 'string',
'GroupName': 'string',
'GroupId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'GroupPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
]
},
],
'RoleDetailList': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'InstanceProfileList': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'RolePolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'Policies': [
{
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1),
'PolicyVersionList': [
{
'Document': 'string',
'VersionId': 'string',
'IsDefaultVersion': True|False,
'CreateDate': datetime(2015, 1, 1)
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful GetAccountAuthorizationDetails request.
UserDetailList (list) --
A list containing information about IAM users.
(dict) --
Contains information about an IAM user, including all the user's policies and all the IAM groups the user is in.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
UserPolicyList (list) --
A list of the inline policies embedded in the user.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
GroupList (list) --
A list of IAM groups that the user is in.
(string) --
AttachedManagedPolicies (list) --
A list of the managed policies attached to the user.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
GroupDetailList (list) --
A list containing information about IAM groups.
(dict) --
Contains information about an IAM group, including all of the group's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
GroupName (string) --
The friendly name that identifies the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the group was created.
GroupPolicyList (list) --
A list of the inline policies embedded in the group.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of the managed policies attached to the group.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
RoleDetailList (list) --
A list containing information about IAM roles.
(dict) --
Contains information about an IAM role, including all of the role's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The trust policy that grants permission to assume the role.
InstanceProfileList (list) --
A list of instance profiles that contain this role.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
RolePolicyList (list) --
A list of inline policies embedded in the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of managed policies attached to the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Policies (list) --
A list containing information about managed policies.
(dict) --
Contains information about a managed policy, including the policy's ARN, versions, and the number of principal entities (users, groups, and roles) that the policy is attached to.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
For more information about managed policies, see Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Path (string) --
The path to the policy.
For more information about paths, see IAM Identifiers in the Using IAM guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default (operative) version.
For more information about policy versions, see Versioning for Managed Policies in the Using IAM guide.
AttachmentCount (integer) --
The number of principal entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used as the permissions boundary.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
PolicyVersionList (list) --
A list containing information about the versions of the policy.
(dict) --
Contains information about a version of a managed policy.
This data type is used as a response element in the CreatePolicyVersion , GetPolicyVersion , ListPolicyVersions , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
Document (string) --
The policy document.
The policy document is returned in the response to the GetPolicyVersion and GetAccountAuthorizationDetails operations. It is not returned in the response to the CreatePolicyVersion or ListPolicyVersions operations.
The policy document returned in this structure is URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
VersionId (string) --
The identifier for the policy version.
Policy version identifiers always begin with v (always lowercase). When a policy is created, the first policy version is v1 .
IsDefaultVersion (boolean) --
Specifies whether the policy version is set as the policy's default version.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy version was created.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Users': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Returns a list of IAM users that are in the specified IAM group. You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.get_group(
GroupName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the group.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Group': {
'Path': 'string',
'GroupName': 'string',
'GroupId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1)
},
'Users': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful GetGroup request.
Group (dict) --
A structure that contains details about the group.
Path (string) --
The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
GroupName (string) --
The friendly name that identifies the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the group. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the group was created.
Users (list) --
A list of users in the group.
(dict) --
Contains information about an IAM user entity.
This data type is used as a response element in the following operations:
CreateUser
GetUser
ListUsers
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfile': {'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, see About Instance Profiles in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.get_instance_profile(
InstanceProfileName='string'
)
string
[REQUIRED]
The name of the instance profile to get information about.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful GetInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Policy': {'PermissionsBoundaryUsageCount': 'integer'}}
Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached. To retrieve the list of the specific users, groups, and roles that the policy is attached to, use the ListEntitiesForPolicy API. This API returns metadata about the policy. To retrieve the actual policy document for a specific version of the policy, use GetPolicyVersion .
This API retrieves information about managed policies. To retrieve information about an inline policy that is embedded with an IAM user, group, or role, use the GetUserPolicy , GetGroupPolicy , or GetRolePolicy API.
For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.get_policy(
PolicyArn='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the managed policy that you want information about.
For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
dict
Response Syntax
{
'Policy': {
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Contains the response to a successful GetPolicy request.
Policy (dict) --
A structure containing details about the policy.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Path (string) --
The path to the policy.
For more information about paths, see IAM Identifiers in the Using IAM guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default version.
AttachmentCount (integer) --
The number of entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used to set the permissions boundary.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
This element is included in the response to the GetPolicy operation. It is not included in the response to the ListPolicies operation.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
{'Role': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role. For more information about roles, see Working with Roles .
Note
Policies returned by this API are URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
See also: AWS API Documentation
Request Syntax
client.get_role(
RoleName='string'
)
string
[REQUIRED]
The name of the IAM role to get information about.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful GetRole request.
Role (dict) --
A structure containing details about the IAM role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'User': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.
If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID used to sign the request to this API.
See also: AWS API Documentation
Request Syntax
client.get_user(
UserName='string'
)
string
The name of the user to get information about.
This parameter is optional. If it is not included, it defaults to the user making the request. This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful GetUser request.
User (dict) --
A structure containing details about the IAM user.
Warning
Due to a service issue, password last used data does not include password use from May 3rd 2018 22:50 PDT to May 23rd 2018 14:08 PDT. This affects last sign-in dates shown in the IAM console and password last used dates in the IAM credential report , and returned by this GetUser API. If users signed in during the affected time, the password last used date that is returned is the date the user last signed in before May 3rd 2018. For users that signed in after May 23rd 2018 14:08 PDT, the returned password last used date is accurate.
If you use password last used information to identify unused credentials for deletion, such as deleting users who did not sign in to AWS in the last 90 days, we recommend that you adjust your evaluation window to include dates after May 23rd 2018. Alternatively, if your users use access keys to access AWS programmatically you can refer to access key last used information because it is accurate for all dates.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'PolicyUsageFilter': 'PermissionsPolicy | PermissionsBoundary'}
Lists all IAM users, groups, and roles that the specified managed policy is attached to.
You can use the optional EntityFilter parameter to limit the results to a particular type of entity (users, groups, or roles). For example, to list only the roles that are attached to the specified policy, set EntityFilter to Role .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_entities_for_policy(
PolicyArn='string',
EntityFilter='User'|'Role'|'Group'|'LocalManagedPolicy'|'AWSManagedPolicy',
PathPrefix='string',
PolicyUsageFilter='PermissionsPolicy'|'PermissionsBoundary',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.
For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
string
The entity type to use for filtering the results.
For example, when EntityFilter is Role , only the roles that are attached to the specified policy are returned. This parameter is optional. If it is not included, all attached entities (users, groups, and roles) are returned. The argument for this parameter must be one of the valid values listed below.
string
The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all entities.
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
The policy usage method to use for filtering the results.
To list only permissions policies, set PolicyUsageFilter to PermissionsPolicy . To list only the policies used to set permissions boundaries, set the value to PermissionsBoundary .
This parameter is optional. If it is not included, all policies are returned.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'PolicyGroups': [
{
'GroupName': 'string',
'GroupId': 'string'
},
],
'PolicyUsers': [
{
'UserName': 'string',
'UserId': 'string'
},
],
'PolicyRoles': [
{
'RoleName': 'string',
'RoleId': 'string'
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListEntitiesForPolicy request.
PolicyGroups (list) --
A list of IAM groups that the policy is attached to.
(dict) --
Contains information about a group that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
GroupName (string) --
The name (friendly name, not ARN) identifying the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the IAM User Guide .
PolicyUsers (list) --
A list of IAM users that the policy is attached to.
(dict) --
Contains information about a user that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
UserName (string) --
The name (friendly name, not ARN) identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the IAM User Guide .
PolicyRoles (list) --
A list of IAM roles that the policy is attached to.
(dict) --
Contains information about a role that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
RoleName (string) --
The name (friendly name, not ARN) identifying the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the IAM User Guide .
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfiles': {'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Lists the instance profiles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all instance profiles whose path starts with /application_abc/component_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all instance profiles. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfiles request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfiles': {'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Lists the instance profiles that have the specified associated IAM role. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles_for_role(
RoleName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the role to list instance profiles for.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfilesForRole request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'PolicyUsageFilter': 'PermissionsPolicy | PermissionsBoundary'}
Response {'Policies': {'PermissionsBoundaryUsageCount': 'integer'}}
Lists all the managed policies that are available in your AWS account, including your own customer-defined managed policies and all AWS managed policies.
You can filter the list of policies that is returned using the optional OnlyAttached , Scope , and PathPrefix parameters. For example, to list only the customer managed policies in your AWS account, set Scope to Local . To list only AWS managed policies, set Scope to AWS .
You can paginate the results using the MaxItems and Marker parameters.
For more information about managed policies, see Managed Policies and Inline Policies in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.list_policies(
Scope='All'|'AWS'|'Local',
OnlyAttached=True|False,
PathPrefix='string',
PolicyUsageFilter='PermissionsPolicy'|'PermissionsBoundary',
Marker='string',
MaxItems=123
)
string
The scope to use for filtering the results.
To list only AWS managed policies, set Scope to AWS . To list only the customer managed policies in your AWS account, set Scope to Local .
This parameter is optional. If it is not included, or if it is set to All , all policies are returned.
boolean
A flag to filter the results to only the attached policies.
When OnlyAttached is true , the returned list contains only the policies that are attached to an IAM user, group, or role. When OnlyAttached is false , or when the parameter is not included, all policies are returned.
string
The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
The policy usage method to use for filtering the results.
To list only permissions policies, set PolicyUsageFilter to PermissionsPolicy . To list only the policies used to set permissions boundaries, set the value to PermissionsBoundary .
This parameter is optional. If it is not included, all policies are returned.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Policies': [
{
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1)
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListPolicies request.
Policies (list) --
A list of policies.
(dict) --
Contains information about a managed policy.
This data type is used as a response element in the CreatePolicy , GetPolicy , and ListPolicies operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Path (string) --
The path to the policy.
For more information about paths, see IAM Identifiers in the Using IAM guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default version.
AttachmentCount (integer) --
The number of entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used to set the permissions boundary.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
This element is included in the response to the GetPolicy operation. It is not included in the response to the ListPolicies operation.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Roles': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Lists the IAM roles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about roles, go to Working with Roles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_roles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all roles whose path starts with /application_abc/component_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all roles. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListRoles request.
Roles (list) --
A list of roles.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Users': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Lists the IAM users that have the specified path prefix. If no path prefix is specified, the operation returns all users in the AWS account. If there are none, the operation returns an empty list.
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_users(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example: /division_abc/subdivision_xyz/ , which would get all user names whose path starts with /division_abc/subdivision_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all user names. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Users': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListUsers request.
Users (list) --
A list of users.
(dict) --
Contains information about an IAM user entity.
This data type is used as a response element in the following operations:
CreateUser
GetUser
ListUsers
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'VirtualMFADevices': {'User': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}}
Lists the virtual MFA devices defined in the AWS account by assignment status. If you do not specify an assignment status, the operation returns a list of all virtual MFA devices. Assignment status can be Assigned , Unassigned , or Any .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_virtual_mfa_devices(
AssignmentStatus='Assigned'|'Unassigned'|'Any',
Marker='string',
MaxItems=123
)
string
The status (Unassigned or Assigned ) of the devices to list. If you do not specify an AssignmentStatus , the operation defaults to Any which lists both assigned and unassigned virtual MFA devices.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'VirtualMFADevices': [
{
'SerialNumber': 'string',
'Base32StringSeed': b'bytes',
'QRCodePNG': b'bytes',
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
'EnableDate': datetime(2015, 1, 1)
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListVirtualMFADevices request.
VirtualMFADevices (list) --
The list of virtual MFA devices in the current account that match the AssignmentStatus value that was passed in the request.
(dict) --
Contains information about a virtual MFA device.
SerialNumber (string) --
The serial number associated with VirtualMFADevice .
Base32StringSeed (bytes) --
The Base32 seed defined as specified in RFC3548 . The Base32StringSeed is Base64-encoded.
QRCodePNG (bytes) --
A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
User (dict) --
The IAM user associated with this virtual MFA device.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
EnableDate (datetime) --
The date and time on which the virtual MFA device was enabled.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Role': {'PermissionsBoundary': {'PermissionsBoundaryArn': 'string',
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy'}}}
Use instead.
Modifies only the description of a role. This operation performs the same function as the Description parameter in the UpdateRole operation.
See also: AWS API Documentation
Request Syntax
client.update_role_description(
RoleName='string',
Description='string'
)
string
[REQUIRED]
The name of the role that you want to modify.
string
[REQUIRED]
The new description that you want to apply to the specified role.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Role (dict) --
A structure that contains details about the modified role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.