2018/11/15 - AWS Identity and Access Management - 6 new 16 updated api methods
Changes We are making it easier for you to manage your AWS Identity and Access Management (IAM) resources by enabling you to add tags to your IAM principals (users and roles). Adding tags on IAM principals will enable you to write fewer policies for permissions management and make policies easier to comprehend. Additionally, tags will also make it easier for you to grant access to AWS resources.
Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value.
A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following:
Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject . Or search for all resources with the key name Cost Center and the value 41200 .
Access control - Reference tags in IAM user-based and resource-based policies. You can use tags to restrict access to only an IAM user or role that has a specified tag attached. You can also restrict access to only those resources that have a certain tag attached. For examples of policies that show how to use tags to control access, see Control Access Using IAM Tags in the IAM User Guide .
Cost allocation - Use tags to help track which individuals and teams are using which AWS resources.
Note
Make sure that you have no invalid tags and that you do not exceed the allowed number of tags per role. In either case, the entire request fails and no tags are added to the role.
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.tag_role(
RoleName='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The name of the role that you want to add tags to.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
list
[REQUIRED]
The list of tags that you want to attach to the role. Each tag consists of a key name and an associated value. You can specify this with a JSON string.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
None
Removes the specified tags from the role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.untag_role(
RoleName='string',
TagKeys=[
'string',
]
)
string
[REQUIRED]
The name of the IAM role from which you want to remove tags.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
list
[REQUIRED]
A list of key names as a simple array of strings. The tags with matching keys are removed from the specified role.
(string) --
None
Lists the tags that are attached to the specified role. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.list_role_tags(
RoleName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the IAM role for which you want to see the list of tags.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items that you want in the response. If additional items exist beyond the maximum that you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when more results are available. In that case, the IsTruncated response element returns true , and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Tags (list) --
The list of tags currently that is attached to the role. Each tag consists of a key name and an associated value. If no tags are attached to the specified role, the response contains an empty list.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can use the Marker request parameter to make a subsequent pagination request that retrieves more items. Note that IAM might return fewer than the MaxItems number of results even when more results are available. Check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value.
A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following:
Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject . Or search for all resources with the key name Cost Center and the value 41200 .
Access control - Reference tags in IAM user-based and resource-based policies. You can use tags to restrict access to only an IAM requesting user or to a role that has a specified tag attached. You can also restrict access to only those resources that have a certain tag attached. For examples of policies that show how to use tags to control access, see Control Access Using IAM Tags in the IAM User Guide .
Cost allocation - Use tags to help track which individuals and teams are using which AWS resources.
Note
Make sure that you have no invalid tags and that you do not exceed the allowed number of tags per role. In either case, the entire request fails and no tags are added to the role.
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.tag_user(
UserName='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The name of the user that you want to add tags to.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-
list
[REQUIRED]
The list of tags that you want to attach to the user. Each tag consists of a key name and an associated value.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
None
Lists the tags that are attached to the specified user. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.list_user_tags(
UserName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the IAM user whose tags you want to see.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items that you want in the response. If additional items exist beyond the maximum that you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when more results are available. In that case, the IsTruncated response element returns true , and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Tags (list) --
The list of tags that are currently attached to the user. Each tag consists of a key name and an associated value. If no tags are attached to the specified user, the response contains an empty list.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can use the Marker request parameter to make a subsequent pagination request that retrieves more items. Note that IAM might return fewer than the MaxItems number of results even when more results are available. Check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
Removes the specified tags from the user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.untag_user(
UserName='string',
TagKeys=[
'string',
]
)
string
[REQUIRED]
The name of the IAM user from which you want to remove tags.
This parameter accepts (through its regex pattern ) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-
list
[REQUIRED]
A list of key names as a simple array of strings. The tags with matching keys are removed from the specified user.
(string) --
None
{'InstanceProfile': {'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}
Creates a new instance profile. For information about instance profiles, go to About Instance Profiles .
For information about the number of instance profiles you can create, see Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_instance_profile(
InstanceProfileName='string',
Path='string'
)
string
[REQUIRED]
The name of the instance profile to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful CreateInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the new instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Response {'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Creates a new role for your AWS account. For more information about roles, go to IAM Roles . For information about limitations on role names and the number of roles you can create, go to Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_role(
Path='string',
RoleName='string',
AssumeRolePolicyDocument='string',
Description='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
MaxSessionDuration=123,
PermissionsBoundary='string'
)
string
The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the role to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
Role names are not distinguished by case. For example, you cannot create roles named both "PRODROLE" and "prodrole".
string
[REQUIRED]
The trust relationship policy document that grants an entity permission to assume the role.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
Any printable ASCII character ranging from the space character (u0020) through the end of the ASCII character range
The printable characters in the Basic Latin and Latin-1 Supplement character set (through u00FF)
The special characters tab (u0009), line feed (u000A), and carriage return (u000D)
string
A description of the role.
list
A list of tags that you want to attach to the newly created role. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Note
If any one of the tags is invalid or if you exceed the allowed number of tags per role, then the entire request fails and the role is not created.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
integer
The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
Anyone who assumes the role from the AWS CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM Roles in the IAM User Guide .
string
The ARN of the policy that is used to set the permissions boundary for the role.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful CreateRole request.
Role (dict) --
A structure containing details about the new role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Creates an IAM role that is linked to a specific AWS service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see Using Service-Linked Roles in the IAM User Guide .
To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.
See also: AWS API Documentation
Request Syntax
client.create_service_linked_role(
AWSServiceName='string',
Description='string',
CustomSuffix='string'
)
string
[REQUIRED]
The service principal for the AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com .
Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see AWS Services That Work with IAM in the IAM User Guide and look for the services that have Yes in the Service-Linked Role column. Choose the Yes link to view the service-linked role documentation for that service.
string
The description of the role.
string
A string that you provide, which is combined with the service-provided prefix to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.
Some services do not support the CustomSuffix parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Role (dict) --
A Role object that contains details about the newly created role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Response {'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Creates a new IAM user for your AWS account.
For information about limitations on the number of IAM users you can create, see Limitations on IAM Entities in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.create_user(
Path='string',
UserName='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
PermissionsBoundary='string'
)
string
The path for the user name. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the user to create.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
list
A list of tags that you want to attach to the newly created user. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Note
If any one of the tags is invalid or if you exceed the allowed number of tags per user, then the entire request fails and the user is not created.
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
string
The ARN of the policy that is used to set the permissions boundary for the user.
dict
Response Syntax
{
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful CreateUser request.
User (dict) --
A structure with details about the new IAM user.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'VirtualMFADevice': {'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}
Creates a new virtual MFA device for the AWS account. After creating the virtual MFA, use EnableMFADevice to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, go to Using a Virtual MFA Device in the IAM User Guide .
For information about limits on the number of MFA devices you can create, see Limitations on Entities in the IAM User Guide .
Warning
The seed information contained in the QR code and the Base32 string should be treated like any other secret access information, such as your AWS access keys or your passwords. After you provision your virtual device, you should ensure that the information is destroyed following secure procedures.
See also: AWS API Documentation
Request Syntax
client.create_virtual_mfa_device(
Path='string',
VirtualMFADeviceName='string'
)
string
The path for the virtual MFA device. For more information about paths, see IAM Identifiers in the IAM User Guide .
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'VirtualMFADevice': {
'SerialNumber': 'string',
'Base32StringSeed': b'bytes',
'QRCodePNG': b'bytes',
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
'EnableDate': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
Contains the response to a successful CreateVirtualMFADevice request.
VirtualMFADevice (dict) --
A structure containing details about the new virtual MFA device.
SerialNumber (string) --
The serial number associated with VirtualMFADevice .
Base32StringSeed (bytes) --
The Base32 seed defined as specified in RFC3548 . The Base32StringSeed is Base64-encoded.
QRCodePNG (bytes) --
A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
User (dict) --
The IAM user associated with this virtual MFA device.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
EnableDate (datetime) --
The date and time on which the virtual MFA device was enabled.
{'RoleDetailList': {'InstanceProfileList': {'Roles': {'Tags': [{'Key': 'string',
'Value': 'string'}]}},
'Tags': [{'Key': 'string', 'Value': 'string'}]},
'UserDetailList': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Retrieves information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another. Use this API to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account.
Note
Policies returned by this API are URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.get_account_authorization_details(
Filter=[
'User'|'Role'|'Group'|'LocalManagedPolicy'|'AWSManagedPolicy',
],
MaxItems=123,
Marker='string'
)
list
A list of entity types used to filter the results. Only the entities that match the types you specify are included in the output. Use the value LocalManagedPolicy to include customer managed policies.
The format for this parameter is a comma-separated (if more than one) list of strings. Each string value in the list must be one of the valid values listed below.
(string) --
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
dict
Response Syntax
{
'UserDetailList': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'UserPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'GroupList': [
'string',
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'GroupDetailList': [
{
'Path': 'string',
'GroupName': 'string',
'GroupId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'GroupPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
]
},
],
'RoleDetailList': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'InstanceProfileList': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'RolePolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'Policies': [
{
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1),
'PolicyVersionList': [
{
'Document': 'string',
'VersionId': 'string',
'IsDefaultVersion': True|False,
'CreateDate': datetime(2015, 1, 1)
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful GetAccountAuthorizationDetails request.
UserDetailList (list) --
A list containing information about IAM users.
(dict) --
Contains information about an IAM user, including all the user's policies and all the IAM groups the user is in.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
UserPolicyList (list) --
A list of the inline policies embedded in the user.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
GroupList (list) --
A list of IAM groups that the user is in.
(string) --
AttachedManagedPolicies (list) --
A list of the managed policies attached to the user.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
GroupDetailList (list) --
A list containing information about IAM groups.
(dict) --
Contains information about an IAM group, including all of the group's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
GroupName (string) --
The friendly name that identifies the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the group was created.
GroupPolicyList (list) --
A list of the inline policies embedded in the group.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of the managed policies attached to the group.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
RoleDetailList (list) --
A list containing information about IAM roles.
(dict) --
Contains information about an IAM role, including all of the role's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The trust policy that grants permission to assume the role.
InstanceProfileList (list) --
A list of instance profiles that contain this role.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
RolePolicyList (list) --
A list of inline policies embedded in the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of managed policies attached to the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies , ListAttachedRolePolicies , ListAttachedUserPolicies , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Policies (list) --
A list containing information about managed policies.
(dict) --
Contains information about a managed policy, including the policy's ARN, versions, and the number of principal entities (users, groups, and roles) that the policy is attached to.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
For more information about managed policies, see Managed Policies and Inline Policies in the Using IAM guide.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference .
Path (string) --
The path to the policy.
For more information about paths, see IAM Identifiers in the Using IAM guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default (operative) version.
For more information about policy versions, see Versioning for Managed Policies in the Using IAM guide.
AttachmentCount (integer) --
The number of principal entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used as the permissions boundary.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
PolicyVersionList (list) --
A list containing information about the versions of the policy.
(dict) --
Contains information about a version of a managed policy.
This data type is used as a response element in the CreatePolicyVersion , GetPolicyVersion , ListPolicyVersions , and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
Document (string) --
The policy document.
The policy document is returned in the response to the GetPolicyVersion and GetAccountAuthorizationDetails operations. It is not returned in the response to the CreatePolicyVersion or ListPolicyVersions operations.
The policy document returned in this structure is URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
VersionId (string) --
The identifier for the policy version.
Policy version identifiers always begin with v (always lowercase). When a policy is created, the first policy version is v1 .
IsDefaultVersion (boolean) --
Specifies whether the policy version is set as the policy's default version.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the policy version was created.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Users': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Returns a list of IAM users that are in the specified IAM group. You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.get_group(
GroupName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the group.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Group': {
'Path': 'string',
'GroupName': 'string',
'GroupId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1)
},
'Users': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful GetGroup request.
Group (dict) --
A structure that contains details about the group.
Path (string) --
The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
GroupName (string) --
The friendly name that identifies the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the group. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the group was created.
Users (list) --
A list of users in the group.
(dict) --
Contains information about an IAM user entity.
This data type is used as a response element in the following operations:
CreateUser
GetUser
ListUsers
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfile': {'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}
Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, see About Instance Profiles in the IAM User Guide .
See also: AWS API Documentation
Request Syntax
client.get_instance_profile(
InstanceProfileName='string'
)
string
[REQUIRED]
The name of the instance profile to get information about.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful GetInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role. For more information about roles, see Working with Roles .
Note
Policies returned by this API are URL-encoded compliant with RFC 3986 . You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
See also: AWS API Documentation
Request Syntax
client.get_role(
RoleName='string'
)
string
[REQUIRED]
The name of the IAM role to get information about.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful GetRole request.
Role (dict) --
A structure containing details about the IAM role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.
If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID used to sign the request to this API.
See also: AWS API Documentation
Request Syntax
client.get_user(
UserName='string'
)
string
The name of the user to get information about.
This parameter is optional. If it is not included, it defaults to the user making the request. This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Contains the response to a successful GetUser request.
User (dict) --
A structure containing details about the IAM user.
Warning
Due to a service issue, password last used data does not include password use from May 3rd 2018 22:50 PDT to May 23rd 2018 14:08 PDT. This affects last sign-in dates shown in the IAM console and password last used dates in the IAM credential report , and returned by this GetUser API. If users signed in during the affected time, the password last used date that is returned is the date the user last signed in before May 3rd 2018. For users that signed in after May 23rd 2018 14:08 PDT, the returned password last used date is accurate.
If you use password last used information to identify unused credentials for deletion, such as deleting users who did not sign in to AWS in the last 90 days, we recommend that you adjust your evaluation window to include dates after May 23rd 2018. Alternatively, if your users use access keys to access AWS programmatically you can refer to access key last used information because it is accurate for all dates.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
{'InstanceProfiles': {'Roles': {'Tags': [{'Key': 'string',
'Value': 'string'}]}}}
Lists the instance profiles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all instance profiles whose path starts with /application_abc/component_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all instance profiles. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfiles request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfiles': {'Roles': {'Tags': [{'Key': 'string',
'Value': 'string'}]}}}
Lists the instance profiles that have the specified associated IAM role. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles_for_role(
RoleName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the role to list instance profiles for.
This parameter allows (per its regex pattern ) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfilesForRole request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
CreateInstanceProfile
GetInstanceProfile
ListInstanceProfiles
ListInstanceProfilesForRole
Path (string) --
The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Lists the IAM roles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about roles, go to Working with Roles .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_roles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all roles whose path starts with /application_abc/component_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all roles. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListRoles request.
Roles (list) --
A list of roles.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Users': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Lists the IAM users that have the specified path prefix. If no path prefix is specified, the operation returns all users in the AWS account. If there are none, the operation returns an empty list.
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_users(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example: /division_abc/subdivision_xyz/ , which would get all user names whose path starts with /division_abc/subdivision_xyz/ .
This parameter is optional. If it is not included, it defaults to a slash (/), listing all user names. This parameter allows (per its regex pattern ) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Users': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListUsers request.
Users (list) --
A list of users.
(dict) --
Contains information about an IAM user entity.
This data type is used as a response element in the following operations:
CreateUser
GetUser
ListUsers
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'VirtualMFADevices': {'User': {'Tags': [{'Key': 'string',
'Value': 'string'}]}}}
Lists the virtual MFA devices defined in the AWS account by assignment status. If you do not specify an assignment status, the operation returns a list of all virtual MFA devices. Assignment status can be Assigned , Unassigned , or Any .
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_virtual_mfa_devices(
AssignmentStatus='Assigned'|'Unassigned'|'Any',
Marker='string',
MaxItems=123
)
string
The status (Unassigned or Assigned ) of the devices to list. If you do not specify an AssignmentStatus , the operation defaults to Any which lists both assigned and unassigned virtual MFA devices.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true .
If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'VirtualMFADevices': [
{
'SerialNumber': 'string',
'Base32StringSeed': b'bytes',
'QRCodePNG': b'bytes',
'User': {
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'PasswordLastUsed': datetime(2015, 1, 1),
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
},
'EnableDate': datetime(2015, 1, 1)
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListVirtualMFADevices request.
VirtualMFADevices (list) --
The list of virtual MFA devices in the current account that match the AssignmentStatus value that was passed in the request.
(dict) --
Contains information about a virtual MFA device.
SerialNumber (string) --
The serial number associated with VirtualMFADevice .
Base32StringSeed (bytes) --
The Base32 seed defined as specified in RFC3548 . The Base32StringSeed is Base64-encoded.
QRCodePNG (bytes) --
A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
User (dict) --
The IAM user associated with this virtual MFA device.
Path (string) --
The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the user was created.
PasswordLastUsed (datetime) --
The date and time, in ISO 8601 date-time format , when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
The user never had a password.
A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
Tags (list) --
A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
EnableDate (datetime) --
The date and time on which the virtual MFA device was enabled.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
Marker (string) --
When IsTruncated is true , this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}
Use instead.
Modifies only the description of a role. This operation performs the same function as the Description parameter in the UpdateRole operation.
See also: AWS API Documentation
Request Syntax
client.update_role_description(
RoleName='string',
Description='string'
)
string
[REQUIRED]
The name of the role that you want to modify.
string
[REQUIRED]
The new description that you want to apply to the specified role.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
}
}
}
Response Structure
(dict) --
Role (dict) --
A structure that contains details about the modified role.
Path (string) --
The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format , when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
Tags (list) --
A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
(dict) --
A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide .
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources , Accounting , and Support . Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
Note
AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide .
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy .
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.