/**
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
* SPDX-License-Identifier: Apache-2.0.
*/
#pragma once
#include Identity and Access
* Management (IAM) is a web service for securely controlling access to Amazon Web
* Services services. With IAM, you can centrally manage users, security
* credentials such as access keys, and permissions that control which Amazon Web
* Services resources users and applications can access. For more information about
* IAM, see Identity and Access Management
* (IAM) and the Identity and Access
* Management User Guide. Adds a new client ID (also known as audience) to the list of client IDs
* already registered for the specified IAM OpenID Connect (OIDC) provider
* resource. This operation is idempotent; it does not fail or return an
* error if you add an existing client ID to the provider.See Also:
* AWS
* API Reference
Adds the specified IAM role to the specified instance profile. An instance * profile can contain only one role, and this quota cannot be increased. You can * remove the existing role and then add a different role to an instance profile. * You must then wait for the change to appear across all of Amazon Web Services * because of eventual * consistency. To force the change, you must disassociate * the instance profile and then associate * the instance profile, or you can stop your instance and then restart it.
*The caller of this operation must be granted the PassRole
* permission on the IAM role by a permissions policy.
For more * information about roles, see IAM * roles in the IAM User Guide. For more information about instance * profiles, see Using * instance profiles in the IAM User Guide.
Adds the specified user to the specified group.
Attaches the specified managed policy to the specified IAM group.
You
* use this operation to attach a managed policy to a group. To embed an inline
* policy in a group, use
* PutGroupPolicy
.
As a best practice, you can validate * your IAM policies. To learn more, see Validating * IAM policies in the IAM User Guide.
For more information about * policies, see Managed * policies and inline policies in the IAM User Guide.
Attaches the specified managed policy to the specified IAM role. When you * attach a managed policy to a role, the managed policy becomes part of the role's * permission (access) policy.
You cannot use a managed policy as the
* role's trust policy. The role's trust policy is created at the same time as the
* role, using
* CreateRole
. You can update a role's trust policy using
* UpdateAssumerolePolicy
.
Use this operation to
* attach a managed policy to a role. To embed an inline policy in a role,
* use
* PutRolePolicy
. For more information about policies, see Managed
* policies and inline policies in the IAM User Guide.
As a best * practice, you can validate your IAM policies. To learn more, see Validating * IAM policies in the IAM User Guide.
Attaches the specified managed policy to the specified user.
You use
* this operation to attach a managed policy to a user. To embed an inline
* policy in a user, use
* PutUserPolicy
.
As a best practice, you can validate * your IAM policies. To learn more, see Validating * IAM policies in the IAM User Guide.
For more information about * policies, see Managed * policies and inline policies in the IAM User Guide.
Changes the password of the IAM user who is calling this operation. This * operation can be performed using the CLI, the Amazon Web Services API, or the * My Security Credentials page in the Amazon Web Services Management * Console. The Amazon Web Services account root user password is not affected by * this operation.
Use UpdateLoginProfile to use the CLI, the Amazon * Web Services API, or the Users page in the IAM console to change the * password for any IAM user. For more information about modifying passwords, see * Managing * passwords in the IAM User Guide.
Creates a new Amazon Web Services secret access key and corresponding Amazon
* Web Services access key ID for the specified user. The default status for new
* keys is Active
.
If you do not specify a user name, IAM * determines the user name implicitly based on the Amazon Web Services access key * ID signing the request. This operation works for access keys under the Amazon * Web Services account. Consequently, you can use this operation to manage Amazon * Web Services account root user credentials. This is true even if the Amazon Web * Services account has no associated users.
For information about quotas * on the number of keys you can create, see IAM * and STS quotas in the IAM User Guide.
To ensure * the security of your Amazon Web Services account, the secret access key is * accessible only during key and user creation. You must save the key (for * example, in a text file) if you want to be able to access it again. If a secret * key is lost, you can delete the access keys for the associated user and then * create new keys.
Creates an alias for your Amazon Web Services account. For information about * using an Amazon Web Services account alias, see Creating, * deleting, and listing an Amazon Web Services account alias in the Amazon * Web Services Sign-In User Guide.
Creates a new group.
For information about the number of groups you * can create, see IAM * and STS quotas in the IAM User Guide.
Creates a new instance profile. For information about instance profiles, see * Using * roles for applications on Amazon EC2 in the IAM User Guide, and Instance * profiles in the Amazon EC2 User Guide.
For information about * the number of instance profiles you can create, see IAM * object quotas in the IAM User Guide.
Creates a password for the specified IAM user. A password allows an IAM user * to access Amazon Web Services services through the Amazon Web Services * Management Console.
You can use the CLI, the Amazon Web Services API, or * the Users page in the IAM console to create a password for any IAM user. * Use ChangePassword to update your own existing password in the My * Security Credentials page in the Amazon Web Services Management Console.
*For more information about managing passwords, see Managing * passwords in the IAM User Guide.
Creates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC).
The OIDC * provider that you create with this operation can be used as a principal in a * role's trust policy. Such a policy establishes a trust relationship between * Amazon Web Services and the OIDC provider.
If you are using an OIDC * identity provider from Google, Facebook, or Amazon Cognito, you don't need to * create a separate IAM identity provider. These OIDC identity providers are * already built-in to Amazon Web Services and are available for your use. Instead, * you can move directly to creating new roles using your identity provider. To * learn more, see Creating * a role for web identity or OpenID connect federation in the IAM User * Guide.
When you create the IAM OIDC provider, you specify the * following:
The URL of the OIDC identity provider (IdP) to * trust
A list of client IDs (also known as audiences) that * identify the application or applications allowed to authenticate using the OIDC * provider
A list of tags that are attached to the specified IAM * OIDC provider
A list of thumbprints of one or more server * certificates that the IdP uses
You get all of this * information from the OIDC IdP you want to use to access Amazon Web Services.
*Amazon Web Services secures communication with some OIDC identity * providers (IdPs) through our library of trusted root certificate authorities * (CAs) instead of using a certificate thumbprint to verify your IdP server * certificate. These OIDC IdPs include Auth0, GitHub, Google, and those that use * an Amazon S3 bucket to host a JSON Web Key Set (JWKS) endpoint. In these cases, * your legacy thumbprint remains in your configuration, but is no longer used for * validation.
The trust for the OIDC provider is derived * from the IAM provider that this operation creates. Therefore, it is best to * limit access to the CreateOpenIDConnectProvider operation to highly * privileged users.
Creates a new managed policy for your Amazon Web Services account.
*This operation creates a policy version with a version identifier of
* v1
and sets v1 as the policy's default version. For more
* information about policy versions, see Versioning
* for managed policies in the IAM User Guide.
As a best * practice, you can validate your IAM policies. To learn more, see Validating * IAM policies in the IAM User Guide.
For more information about * managed policies in general, see Managed * policies and inline policies in the IAM User Guide.
Creates a new version of the specified managed policy. To update a managed * policy, you create a new policy version. A managed policy can have up to five * versions. If the policy has five versions, you must delete an existing version * using DeletePolicyVersion before you create a new version.
*Optionally, you can set the new version as the policy's default version. The * default version is the version that is in effect for the IAM users, groups, and * roles to which the policy is attached.
For more information about managed * policy versions, see Versioning * for managed policies in the IAM User Guide.
Creates a new role for your Amazon Web Services account.
For more * information about roles, see IAM * roles in the IAM User Guide. For information about quotas for role * names and the number of roles you can create, see IAM * and STS quotas in the IAM User Guide.
Creates an IAM resource that describes an identity provider (IdP) that * supports SAML 2.0.
The SAML provider resource that you create with this * operation can be used as a principal in an IAM role's trust policy. Such a * policy can enable federated users who sign in using the SAML IdP to assume the * role. You can create an IAM role that supports Web-based single sign-on (SSO) to * the Amazon Web Services Management Console or one that supports API access to * Amazon Web Services.
When you create the SAML provider resource, you * upload a SAML metadata document that you get from your IdP. That document * includes the issuer's name, expiration information, and keys that can be used to * validate the SAML authentication response (assertions) that the IdP sends. You * must generate the metadata document using the identity management software that * is used as your organization's IdP.
This operation requires Signature * Version 4.
For more information, see Enabling * SAML 2.0 federated users to access the Amazon Web Services Management * Console and About * SAML 2.0-based federation in the IAM User Guide.
Creates an IAM role that is linked to a specific Amazon Web Services service. * The service controls the attached policies and when the role can be deleted. * This helps ensure that the service is not broken by an unexpectedly changed or * deleted role, which could put your Amazon Web Services resources into an unknown * state. Allowing the service to control the role helps improve service stability * and proper cleanup when a service and its role are no longer needed. For more * information, see Using * service-linked roles in the IAM User Guide.
To attach a * policy to this service-linked role, you must make the request using the Amazon * Web Services service that depends on this role.
Generates a set of credentials consisting of a user name and password that * can be used to access the service specified in the request. These credentials * are generated by IAM, and can be used only for the specified service.
*You can have a maximum of two sets of service-specific credentials for each * supported service per user.
You can create service-specific credentials * for CodeCommit and Amazon Keyspaces (for Apache Cassandra).
You can reset * the password to a new service-generated value by calling * ResetServiceSpecificCredential.
For more information about * service-specific credentials, see Using * IAM with CodeCommit: Git credentials, SSH keys, and Amazon Web Services access * keys in the IAM User Guide.
Creates a new IAM user for your Amazon Web Services account.
For * information about quotas for the number of IAM users you can create, see IAM * and STS quotas in the IAM User Guide.
Creates a new virtual MFA device for the Amazon Web Services account. After * creating the virtual MFA, use EnableMFADevice to attach the MFA device to * an IAM user. For more information about creating and working with virtual MFA * devices, see Using * a virtual MFA device in the IAM User Guide.
For information * about the maximum number of MFA devices you can create, see IAM * and STS quotas in the IAM User Guide.
The seed * information contained in the QR code and the Base32 string should be treated * like any other secret access information. In other words, protect the seed * information as you would your Amazon Web Services access keys or your passwords. * After you provision your virtual device, you should ensure that the information * is destroyed following secure procedures.
Deactivates the specified MFA device and removes it from association with the * user name for which it was originally enabled.
For more information about * creating and working with virtual MFA devices, see Enabling * a virtual multi-factor authentication (MFA) device in the IAM User * Guide.
Deletes the access key pair associated with the specified IAM user.
If * you do not specify a user name, IAM determines the user name implicitly based on * the Amazon Web Services access key ID signing the request. This operation works * for access keys under the Amazon Web Services account. Consequently, you can use * this operation to manage Amazon Web Services account root user credentials even * if the Amazon Web Services account has no associated users.
Deletes the specified Amazon Web Services account alias. For information * about using an Amazon Web Services account alias, see Creating, * deleting, and listing an Amazon Web Services account alias in the Amazon * Web Services Sign-In User Guide.
Deletes the password policy for the Amazon Web Services account. There are no * parameters.
Deletes the specified IAM group. The group must not contain any users or have * any attached policies.
Deletes the specified inline policy that is embedded in the specified IAM * group.
A group can also have managed policies attached to it. To detach a * managed policy from a group, use DetachGroupPolicy. For more information * about policies, refer to Managed * policies and inline policies in the IAM User Guide.
Deletes the specified instance profile. The instance profile must not have an * associated role.
Make sure that you do not have any Amazon * EC2 instances running with the instance profile you are about to delete. * Deleting a role or instance profile that is associated with a running instance * will break any applications running on the instance.
For * more information about instance profiles, see Using * instance profiles in the IAM User Guide.
Deletes the password for the specified IAM user, For more information, see Managing * passwords for IAM users.
You can use the CLI, the Amazon Web Services * API, or the Users page in the IAM console to delete a password for any * IAM user. You can use ChangePassword to update, but not delete, your own * password in the My Security Credentials page in the Amazon Web Services * Management Console.
Deleting a user's password does not * prevent a user from accessing Amazon Web Services through the command line * interface or the API. To prevent all user access, you must also either make any * access keys inactive or delete them. For more information about making keys * inactive or deleting them, see UpdateAccessKey and * DeleteAccessKey.
Deletes an OpenID Connect identity provider (IdP) resource object in IAM.
*Deleting an IAM OIDC provider resource does not update any roles that * reference the provider as a principal in their trust policies. Any attempt to * assume a role that references a deleted provider fails.
This operation is * idempotent; it does not fail or return an error if you call the operation for a * provider that does not exist.
Deletes the specified managed policy.
Before you can delete a managed * policy, you must first detach the policy from all users, groups, and roles that * it is attached to. In addition, you must delete all the policy's versions. The * following steps describe the process for deleting a managed policy:
Detach the policy from all users, groups, and roles that the policy is * attached to, using DetachUserPolicy, DetachGroupPolicy, or * DetachRolePolicy. To list all the users, groups, and roles that a policy * is attached to, use ListEntitiesForPolicy.
Delete all * versions of the policy using DeletePolicyVersion. To list the policy's * versions, use ListPolicyVersions. You cannot use * DeletePolicyVersion to delete the version that is marked as the default * version. You delete the policy's default version in the next step of the * process.
Delete the policy (this automatically deletes the * policy's default version) using this operation.
For * information about managed policies, see Managed * policies and inline policies in the IAM User Guide.
Deletes the specified version from the specified managed policy.
You * cannot delete the default version from a policy using this operation. To delete * the default version from a policy, use DeletePolicy. To find out which * version of a policy is marked as the default version, use * ListPolicyVersions.
For information about versions for managed * policies, see Versioning * for managed policies in the IAM User Guide.
Deletes the specified role. Unlike the Amazon Web Services Management * Console, when you delete a role programmatically, you must delete the items * attached to the role manually, or the deletion fails. For more information, see * Deleting * an IAM role. Before attempting to delete a role, remove the following * attached items:
Inline policies (DeleteRolePolicy)
*Attached managed policies (DetachRolePolicy)
Instance profile (RemoveRoleFromInstanceProfile)
Optional – Delete instance profile after detaching from role for resource * clean up (DeleteInstanceProfile)
Make sure * that you do not have any Amazon EC2 instances running with the role you are * about to delete. Deleting a role or instance profile that is associated with a * running instance will break any applications running on the instance.
*Deletes the permissions boundary for the specified IAM role.
You * cannot set the boundary for a service-linked role.
Deleting * the permissions boundary for a role might increase its permissions. For example, * it might allow anyone who assumes the role to perform all the actions granted in * its permissions policies.
Deletes the specified inline policy that is embedded in the specified IAM * role.
A role can also have managed policies attached to it. To detach a * managed policy from a role, use DetachRolePolicy. For more information * about policies, refer to Managed * policies and inline policies in the IAM User Guide.
Deletes a SAML provider resource in IAM.
Deleting the provider * resource from IAM does not update any roles that reference the SAML provider * resource's ARN as a principal in their trust policies. Any attempt to assume a * role that references a non-existent provider resource ARN fails.
* This operation requires Signature * Version 4.
Deletes the specified SSH public key.
The SSH public key deleted by * this operation is used only for authenticating the associated IAM user to an * CodeCommit repository. For more information about using SSH keys to authenticate * to an CodeCommit repository, see Set * up CodeCommit for SSH connections in the CodeCommit User * Guide.
Deletes the specified server certificate.
For more information about * working with server certificates, see Working * with server certificates in the IAM User Guide. This topic also * includes a list of Amazon Web Services services that can use the server * certificates that you manage with IAM.
If you are using a * server certificate with Elastic Load Balancing, deleting the certificate could * have implications for your application. If Elastic Load Balancing doesn't detect * the deletion of bound certificates, it may continue to use the certificates. * This could cause Elastic Load Balancing to stop accepting traffic. We recommend * that you remove the reference to the certificate from Elastic Load Balancing * before using this command to delete the certificate. For more information, see * DeleteLoadBalancerListeners * in the Elastic Load Balancing API Reference.
Submits a service-linked role deletion request and returns a
* DeletionTaskId
, which you can use to check the status of the
* deletion. Before you call this operation, confirm that the role has no active
* sessions and that any resources used by the role in the linked service are
* deleted. If you call this operation more than once for the same service-linked
* role and an earlier deletion task is not complete, then the
* DeletionTaskId
of the earlier request is returned.
If you * submit a deletion request for a service-linked role whose linked service is * still accessing a resource, then the deletion task fails. If it fails, the * GetServiceLinkedRoleDeletionStatus operation returns the reason for the * failure, usually including the resources that must be deleted. To delete the * service-linked role, you must first remove those resources from the linked * service and then submit the deletion request again. Resources are specific to * the service that is linked to the role. For more information about removing * resources from a service, see the Amazon * Web Services documentation for your service.
For more information * about service-linked roles, see Roles * terms and concepts: Amazon Web Services service-linked role in the IAM * User Guide.
Deletes the specified service-specific credential.
Deletes a signing certificate associated with the specified IAM user.
*If you do not specify a user name, IAM determines the user name implicitly * based on the Amazon Web Services access key ID signing the request. This * operation works for access keys under the Amazon Web Services account. * Consequently, you can use this operation to manage Amazon Web Services account * root user credentials even if the Amazon Web Services account has no associated * IAM users.
Deletes the specified IAM user. Unlike the Amazon Web Services Management * Console, when you delete a user programmatically, you must delete the items * attached to the user manually, or the deletion fails. For more information, see * Deleting * an IAM user. Before attempting to delete a user, remove the following * items:
Password (DeleteLoginProfile)
Access keys (DeleteAccessKey)
Signing certificate * (DeleteSigningCertificate)
SSH public key * (DeleteSSHPublicKey)
Git credentials * (DeleteServiceSpecificCredential)
Multi-factor * authentication (MFA) device (DeactivateMFADevice, * DeleteVirtualMFADevice)
Inline policies * (DeleteUserPolicy)
Attached managed policies * (DetachUserPolicy)
Group memberships * (RemoveUserFromGroup)
Deletes the permissions boundary for the specified IAM user.
*Deleting the permissions boundary for a user might increase its permissions * by allowing the user to perform all the actions granted in its permissions * policies.
Deletes the specified inline policy that is embedded in the specified IAM * user.
A user can also have managed policies attached to it. To detach a * managed policy from a user, use DetachUserPolicy. For more information * about policies, refer to Managed * policies and inline policies in the IAM User Guide.
Deletes a virtual MFA device.
You must deactivate a user's * virtual MFA device before you can delete it. For information about deactivating * MFA devices, see DeactivateMFADevice.
Removes the specified managed policy from the specified IAM group.
A * group can also have inline policies embedded with it. To delete an inline * policy, use DeleteGroupPolicy. For information about policies, see Managed * policies and inline policies in the IAM User Guide.
Removes the specified managed policy from the specified role.
A role * can also have inline policies embedded with it. To delete an inline policy, use * DeleteRolePolicy. For information about policies, see Managed * policies and inline policies in the IAM User Guide.
Removes the specified managed policy from the specified user.
A user * can also have inline policies embedded with it. To delete an inline policy, use * DeleteUserPolicy. For information about policies, see Managed * policies and inline policies in the IAM User Guide.
Enables the specified MFA device and associates it with the specified IAM * user. When enabled, the MFA device is required for every subsequent login by the * IAM user associated with the device.
Generates a credential report for the Amazon Web Services account. For more * information about the credential report, see Getting * credential reports in the IAM User Guide.
Generates a report for service last accessed data for Organizations. You can * generate a report for any entities (organization root, organizational unit, or * account) or policies in your organization.
To call this operation, you * must be signed in using your Organizations management account credentials. You * can use your long-term IAM user or root user credentials, or temporary * credentials from assuming an IAM role. SCPs must be enabled for your * organization root. You must have the required IAM and Organizations permissions. * For more information, see Refining * permissions using service last accessed data in the IAM User * Guide.
You can generate a service last accessed data report for * entities by specifying only the entity's path. This data includes a list of * services that are allowed by any service control policies (SCPs) that apply to * the entity.
You can generate a service last accessed data report for a * policy by specifying an entity's path and an optional Organizations policy ID. * This data includes a list of services that are allowed by the specified SCP.
*For each service in both report types, the data includes the most recent * account activity that the policy allows to account principals in the entity or * the entity's children. For important information about the data, reporting * period, permissions required, troubleshooting, and supported Regions see Reducing * permissions using service last accessed data in the IAM User * Guide.
The data includes all attempts to access Amazon * Web Services, not just the successful ones. This includes all attempts that were * made using the Amazon Web Services Management Console, the Amazon Web Services * API through any of the SDKs, or any of the command line tools. An unexpected * entry in the service last accessed data does not mean that an account has been * compromised, because the request might have been denied. Refer to your * CloudTrail logs as the authoritative source for information about all API calls * and whether they were successful or denied access. For more information, see Logging * IAM events with CloudTrail in the IAM User Guide.
*This operation returns a JobId
. Use this parameter in the
* GetOrganizationsAccessReport
operation to check the status of the
* report generation. To check the status of this request, use the
* JobId
parameter in the GetOrganizationsAccessReport
*
operation and test the JobStatus
response parameter. When
* the job is complete, you can retrieve the report.
To generate a service * last accessed data report for entities, specify an entity path without * specifying the optional Organizations policy ID. The type of entity that you * specify determines the data returned in the report.
* Root – When you specify the organizations root as the entity, the * resulting report lists all of the services allowed by SCPs that are attached to * your root. For each service, the report includes data for all accounts in your * organization except the management account, because the management account is * not limited by SCPs.
OU – When you specify an * organizational unit (OU) as the entity, the resulting report lists all of the * services allowed by SCPs that are attached to the OU and its parents. For each * service, the report includes data for all accounts in the OU or its children. * This data excludes the management account, because the management account is not * limited by SCPs.
management account – When you specify * the management account, the resulting report lists all Amazon Web Services * services, because the management account is not limited by SCPs. For each * service, the report includes data for only the management account.
Account – When you specify another account as the entity, the * resulting report lists all of the services allowed by SCPs that are attached to * the account and its parents. For each service, the report includes data for only * the specified account.
To generate a service last accessed * data report for policies, specify an entity path and the optional Organizations * policy ID. The type of entity that you specify determines the data returned for * each service.
Root – When you specify the root entity * and a policy ID, the resulting report lists all of the services that are allowed * by the specified SCP. For each service, the report includes data for all * accounts in your organization to which the SCP applies. This data excludes the * management account, because the management account is not limited by SCPs. If * the SCP is not attached to any entities in the organization, then the report * will return a list of services with no data.
OU – When * you specify an OU entity and a policy ID, the resulting report lists all of the * services that are allowed by the specified SCP. For each service, the report * includes data for all accounts in the OU or its children to which the SCP * applies. This means that other accounts outside the OU that are affected by the * SCP might not be included in the data. This data excludes the management * account, because the management account is not limited by SCPs. If the SCP is * not attached to the OU or one of its children, the report will return a list of * services with no data.
management account – When you * specify the management account, the resulting report lists all Amazon Web * Services services, because the management account is not limited by SCPs. If you * specify a policy ID in the CLI or API, the policy is ignored. For each service, * the report includes data for only the management account.
* Account – When you specify another account entity and a policy ID, the * resulting report lists all of the services that are allowed by the specified * SCP. For each service, the report includes data for only the specified account. * This means that other accounts in the organization that are affected by the SCP * might not be included in the data. If the SCP is not attached to the account, * the report will return a list of services with no data.
Service last accessed data does not use other policy types when determining * whether a principal could access a service. These other policy types include * identity-based policies, resource-based policies, access control lists, IAM * permissions boundaries, and STS assume role policies. It only applies SCP logic. * For more about the evaluation of policy types, see Evaluating * policies in the IAM User Guide.
For more information * about service last accessed data, see Reducing * policy scope by viewing user activity in the IAM User * Guide.
Generates a report that includes details about when an IAM resource (user, * group, role, or policy) was last used in an attempt to access Amazon Web * Services services. Recent activity usually appears within four hours. IAM * reports activity for at least the last 400 days, or less if your Region began * supporting this feature within the last year. For more information, see Regions * where data is tracked.
The service last accessed data * includes all attempts to access an Amazon Web Services API, not just the * successful ones. This includes all attempts that were made using the Amazon Web * Services Management Console, the Amazon Web Services API through any of the * SDKs, or any of the command line tools. An unexpected entry in the service last * accessed data does not mean that your account has been compromised, because the * request might have been denied. Refer to your CloudTrail logs as the * authoritative source for information about all API calls and whether they were * successful or denied access. For more information, see Logging * IAM events with CloudTrail in the IAM User Guide.
*The GenerateServiceLastAccessedDetails
operation returns a
* JobId
. Use this parameter in the following operations to retrieve
* the following details from your report:
* GetServiceLastAccessedDetails – Use this operation for users, groups, * roles, or policies to list every Amazon Web Services service that the resource * could access using permissions policies. For each service, the response includes * information about the most recent access attempt.
The JobId
* returned by GenerateServiceLastAccessedDetail
must be used by the
* same role within a session, or by the same user when used to call
* GetServiceLastAccessedDetail
.
* GetServiceLastAccessedDetailsWithEntities – Use this operation for groups * and policies to list information about the associated entities (users or roles) * that attempted to access a specific Amazon Web Services service.
To check the status of the
* GenerateServiceLastAccessedDetails
request, use the
* JobId
parameter in the same operations and test the
* JobStatus
response parameter.
For additional information * about the permissions policies that allow an identity (user, group, or role) to * access specific services, use the ListPoliciesGrantingServiceAccess * operation.
Service last accessed data does not use other policy * types when determining whether a resource could access a service. These other * policy types include resource-based policies, access control lists, * Organizations policies, IAM permissions boundaries, and STS assume role * policies. It only applies permissions policy logic. For more about the * evaluation of policy types, see Evaluating * policies in the IAM User Guide.
For more information * about service and action last accessed data, see Reducing * permissions using service last accessed data in the IAM User * Guide.
Retrieves information about when the specified access key was last used. The * information includes the date and time of last use, along with the Amazon Web * Services service and Region that were specified in the last request made with * that key.
Retrieves information about all IAM users, groups, roles, and policies in * your Amazon Web Services account, including their relationships to one another. * Use this operation to obtain a snapshot of the configuration of IAM permissions * (users, groups, roles, and policies) in your account.
Policies
* returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL
* decoding method to convert the policy back to plain JSON text. For example, if
* you use Java, you can use the decode
method of the
* java.net.URLDecoder
utility class in the Java SDK. Other languages
* and SDKs provide similar functionality.
You can optionally filter
* the results using the Filter
parameter. You can paginate the
* results using the MaxItems
and Marker
* parameters.
Retrieves the password policy for the Amazon Web Services account. This tells * you the complexity requirements and mandatory rotation periods for the IAM user * passwords in your account. For more information about using a password policy, * see Managing * an IAM password policy.
Retrieves information about IAM entity usage and IAM quotas in the Amazon Web * Services account.
For information about IAM quotas, see IAM * and STS quotas in the IAM User Guide.
Gets a list of all of the context keys referenced in the input policies. The * policies are supplied as a list of one or more strings. To get the context keys * from policies associated with an IAM user, group, or role, use * GetContextKeysForPrincipalPolicy.
Context keys are variables
* maintained by Amazon Web Services and its services that provide details about
* the context of an API query request. Context keys can be evaluated by testing
* against a value specified in an IAM policy. Use
* GetContextKeysForCustomPolicy
to understand what key names and
* values you must supply when you call SimulateCustomPolicy. Note that all
* parameters are shown in unencoded form here for clarity but must be URL encoded
* to be included as a part of a real HTML request.
Gets a list of all of the context keys referenced in all the IAM policies * that are attached to the specified IAM entity. The entity can be an IAM user, * group, or role. If you specify a user, then the request also includes all of the * policies attached to groups that the user is a member of.
You can * optionally include a list of one or more additional policies, specified as * strings. If you want to include only a list of policies by string, use * GetContextKeysForCustomPolicy instead.
Note: This * operation discloses information about the permissions granted to other users. If * you do not want users to see other user's permissions, then consider allowing * them to use GetContextKeysForCustomPolicy instead.
Context keys * are variables maintained by Amazon Web Services and its services that provide * details about the context of an API query request. Context keys can be evaluated * by testing against a value in an IAM policy. Use * GetContextKeysForPrincipalPolicy to understand what key names and values * you must supply when you call SimulatePrincipalPolicy.
Retrieves a credential report for the Amazon Web Services account. For more * information about the credential report, see Getting * credential reports in the IAM User Guide.
Returns a list of IAM users that are in the specified IAM group. You can
* paginate the results using the MaxItems
and Marker
* parameters.
Retrieves the specified inline policy document that is embedded in the * specified IAM group.
Policies returned by this operation are
* URL-encoded compliant with RFC
* 3986. You can use a URL decoding method to convert the policy back to plain
* JSON text. For example, if you use Java, you can use the decode
* method of the java.net.URLDecoder
utility class in the Java SDK.
* Other languages and SDKs provide similar functionality.
An IAM * group can also have managed policies attached to it. To retrieve a managed * policy document that is attached to a group, use GetPolicy to determine * the policy's default version, then use GetPolicyVersion to retrieve the * policy document.
For more information about policies, see Managed * policies and inline policies in the IAM User Guide.
Retrieves information about the specified instance profile, including the * instance profile's path, GUID, ARN, and role. For more information about * instance profiles, see Using * instance profiles in the IAM User Guide.
Retrieves the user name for the specified IAM user. A login profile is
* created when you create a password for the user to access the Amazon Web
* Services Management Console. If the user does not exist or does not have a
* password, the operation returns a 404 (NoSuchEntity
) error.
If you create an IAM user with access to the console, the
* CreateDate
reflects the date you created the initial password for
* the user.
If you create an IAM user with programmatic access, and then
* later add a password for the user to access the Amazon Web Services Management
* Console, the CreateDate
reflects the initial password creation
* date. A user with programmatic access does not have a login profile unless you
* create a password for the user to access the Amazon Web Services Management
* Console.
Retrieves information about an MFA device for a specified user.
Returns information about the specified OpenID Connect (OIDC) provider * resource object in IAM.
Retrieves the service last accessed data report for Organizations that was
* previously generated using the GenerateOrganizationsAccessReport
*
operation. This operation retrieves the status of your report job and
* the report contents.
Depending on the parameters that you passed when you * generated the report, the data returned could include different information. For * details, see GenerateOrganizationsAccessReport.
To call this * operation, you must be signed in to the management account in your organization. * SCPs must be enabled for your organization root. You must have permissions to * perform this operation. For more information, see Refining * permissions using service last accessed data in the IAM User * Guide.
For each service that principals in an account (root user, IAM * users, or IAM roles) could access using SCPs, the operation returns details * about the most recent access attempt. If there was no attempt, the service is * listed without details about the most recent attempt to access the service. If * the operation fails, it returns the reason that it failed.
By default, * the list is sorted by service namespace.
Retrieves information about the specified managed policy, including the * policy's default version and the total number of IAM users, groups, and roles to * which the policy is attached. To retrieve the list of the specific users, * groups, and roles that the policy is attached to, use * ListEntitiesForPolicy. This operation returns metadata about the policy. * To retrieve the actual policy document for a specific version of the policy, use * GetPolicyVersion.
This operation retrieves information about * managed policies. To retrieve information about an inline policy that is * embedded with an IAM user, group, or role, use GetUserPolicy, * GetGroupPolicy, or GetRolePolicy.
For more information * about policies, see Managed * policies and inline policies in the IAM User Guide.
Retrieves information about the specified version of the specified managed * policy, including the policy document.
Policies returned by this
* operation are URL-encoded compliant with RFC 3986. You can use a URL
* decoding method to convert the policy back to plain JSON text. For example, if
* you use Java, you can use the decode
method of the
* java.net.URLDecoder
utility class in the Java SDK. Other languages
* and SDKs provide similar functionality.
To list the available * versions for a policy, use ListPolicyVersions.
This operation * retrieves information about managed policies. To retrieve information about an * inline policy that is embedded in a user, group, or role, use * GetUserPolicy, GetGroupPolicy, or GetRolePolicy.
For * more information about the types of policies, see Managed * policies and inline policies in the IAM User Guide.
For more * information about managed policy versions, see Versioning * for managed policies in the IAM User Guide.
Retrieves information about the specified role, including the role's path, * GUID, ARN, and the role's trust policy that grants permission to assume the * role. For more information about roles, see IAM * roles in the IAM User Guide.
Policies returned by this
* operation are URL-encoded compliant with RFC 3986. You can use a URL
* decoding method to convert the policy back to plain JSON text. For example, if
* you use Java, you can use the decode
method of the
* java.net.URLDecoder
utility class in the Java SDK. Other languages
* and SDKs provide similar functionality.
Retrieves the specified inline policy document that is embedded with the * specified IAM role.
Policies returned by this operation are
* URL-encoded compliant with RFC
* 3986. You can use a URL decoding method to convert the policy back to plain
* JSON text. For example, if you use Java, you can use the decode
* method of the java.net.URLDecoder
utility class in the Java SDK.
* Other languages and SDKs provide similar functionality.
An IAM * role can also have managed policies attached to it. To retrieve a managed policy * document that is attached to a role, use GetPolicy to determine the * policy's default version, then use GetPolicyVersion to retrieve the * policy document.
For more information about policies, see Managed * policies and inline policies in the IAM User Guide.
For more * information about roles, see IAM * roles in the IAM User Guide.
Returns the SAML provider metadocument that was uploaded when the IAM SAML * provider resource object was created or updated.
This operation * requires Signature * Version 4.
Retrieves the specified SSH public key, including metadata about the key.
*The SSH public key retrieved by this operation is used only for * authenticating the associated IAM user to an CodeCommit repository. For more * information about using SSH keys to authenticate to an CodeCommit repository, * see Set * up CodeCommit for SSH connections in the CodeCommit User * Guide.
Retrieves information about the specified server certificate stored in * IAM.
For more information about working with server certificates, see Working * with server certificates in the IAM User Guide. This topic includes a * list of Amazon Web Services services that can use the server certificates that * you manage with IAM.
Retrieves a service last accessed report that was created using the
* GenerateServiceLastAccessedDetails
operation. You can use the
* JobId
parameter in GetServiceLastAccessedDetails
to
* retrieve the status of your report job. When the report is complete, you can
* retrieve the generated report. The report includes a list of Amazon Web Services
* services that the resource (user, group, role, or managed policy) can
* access.
Service last accessed data does not use other policy types * when determining whether a resource could access a service. These other policy * types include resource-based policies, access control lists, Organizations * policies, IAM permissions boundaries, and STS assume role policies. It only * applies permissions policy logic. For more about the evaluation of policy types, * see Evaluating * policies in the IAM User Guide.
For each service that
* the resource could access using permissions policies, the operation returns
* details about the most recent access attempt. If there was no attempt, the
* service is listed without details about the most recent attempt to access the
* service. If the operation fails, the GetServiceLastAccessedDetails
* operation returns the reason that it failed.
The
* GetServiceLastAccessedDetails
operation returns a list of services.
* This list includes the number of entities that have attempted to access the
* service and the date and time of the last attempt. It also returns the ARN of
* the following entity, depending on the resource ARN that you used to generate
* the report:
User – Returns the user ARN that you used * to generate the report
Group – Returns the ARN of the * group member (user) that last attempted to access the service
* Role – Returns the role ARN that you used to generate the report
*Policy – Returns the ARN of the user or role that last * used the policy to attempt to access the service
By default, * the list is sorted by service namespace.
If you specified
* ACTION_LEVEL
granularity when you generated the report, this
* operation returns service and action last accessed data. This includes the most
* recent access attempt for each tracked action within a service. Otherwise, this
* operation returns only service data.
For more information about service * and action last accessed data, see Reducing * permissions using service last accessed data in the IAM User * Guide.
After you generate a group or policy report using the
* GenerateServiceLastAccessedDetails
operation, you can use the
* JobId
parameter in
* GetServiceLastAccessedDetailsWithEntities
. This operation retrieves
* the status of your report job and a list of entities that could have used group
* or policy permissions to access the specified service.
* Group – For a group report, this operation returns a list of users in the * group that could have used the group’s policies in an attempt to access the * service.
Policy – For a policy report, this operation * returns a list of entities (users or roles) that could have used the policy in * an attempt to access the service.
You can also use this * operation for user or role reports to retrieve details about those entities.
*If the operation fails, the
* GetServiceLastAccessedDetailsWithEntities
operation returns the
* reason that it failed.
By default, the list of associated entities is * sorted by date, with the most recent access listed first.
Retrieves the status of your service-linked role deletion. After you use
* DeleteServiceLinkedRole to submit a service-linked role for deletion, you
* can use the DeletionTaskId
parameter in
* GetServiceLinkedRoleDeletionStatus
to check the status of the
* deletion. If the deletion fails, this operation returns the reason that it
* failed, if that information is returned by the service.
Retrieves information about the specified IAM user, including the user's * creation date, path, unique ID, and ARN.
If you do not specify a user * name, IAM determines the user name implicitly based on the Amazon Web Services * access key ID used to sign the request to this operation.
Retrieves the specified inline policy document that is embedded in the * specified IAM user.
Policies returned by this operation are
* URL-encoded compliant with RFC
* 3986. You can use a URL decoding method to convert the policy back to plain
* JSON text. For example, if you use Java, you can use the decode
* method of the java.net.URLDecoder
utility class in the Java SDK.
* Other languages and SDKs provide similar functionality.
An IAM * user can also have managed policies attached to it. To retrieve a managed policy * document that is attached to a user, use GetPolicy to determine the * policy's default version. Then use GetPolicyVersion to retrieve the * policy document.
For more information about policies, see Managed * policies and inline policies in the IAM User Guide.
Returns information about the access key IDs associated with the specified * IAM user. If there is none, the operation returns an empty list.
Although
* each user is limited to a small number of keys, you can still paginate the
* results using the MaxItems
and Marker
parameters.
If the UserName
is not specified, the user name is determined
* implicitly based on the Amazon Web Services access key ID used to sign the
* request. If a temporary access key is used, then UserName
is
* required. If a long-term key is assigned to the user, then UserName
* is not required. This operation works for access keys under the Amazon Web
* Services account. Consequently, you can use this operation to manage Amazon Web
* Services account root user credentials even if the Amazon Web Services account
* has no associated users.
To ensure the security of your Amazon Web * Services account, the secret access key is accessible only during key and user * creation.
Lists the account alias associated with the Amazon Web Services account * (Note: you can have only one). For information about using an Amazon Web * Services account alias, see Creating, * deleting, and listing an Amazon Web Services account alias in the Amazon * Web Services Sign-In User Guide.
Lists all managed policies that are attached to the specified IAM group.
*An IAM group can also have inline policies embedded with it. To list the * inline policies for a group, use ListGroupPolicies. For information about * policies, see Managed * policies and inline policies in the IAM User Guide.
You can
* paginate the results using the MaxItems
and Marker
* parameters. You can use the PathPrefix
parameter to limit the list
* of policies to only those matching the specified path prefix. If there are no
* policies attached to the specified group (or none that match the specified path
* prefix), the operation returns an empty list.
Lists all managed policies that are attached to the specified IAM role.
*An IAM role can also have inline policies embedded with it. To list the * inline policies for a role, use ListRolePolicies. For information about * policies, see Managed * policies and inline policies in the IAM User Guide.
You can
* paginate the results using the MaxItems
and Marker
* parameters. You can use the PathPrefix
parameter to limit the list
* of policies to only those matching the specified path prefix. If there are no
* policies attached to the specified role (or none that match the specified path
* prefix), the operation returns an empty list.
Lists all managed policies that are attached to the specified IAM user.
*An IAM user can also have inline policies embedded with it. To list the * inline policies for a user, use ListUserPolicies. For information about * policies, see Managed * policies and inline policies in the IAM User Guide.
You can
* paginate the results using the MaxItems
and Marker
* parameters. You can use the PathPrefix
parameter to limit the list
* of policies to only those matching the specified path prefix. If there are no
* policies attached to the specified group (or none that match the specified path
* prefix), the operation returns an empty list.
Lists all IAM users, groups, and roles that the specified managed policy is * attached to.
You can use the optional EntityFilter
parameter
* to limit the results to a particular type of entity (users, groups, or roles).
* For example, to list only the roles that are attached to the specified policy,
* set EntityFilter
to Role
.
You can paginate the
* results using the MaxItems
and Marker
* parameters.
Lists the names of the inline policies that are embedded in the specified IAM * group.
An IAM group can also have managed policies attached to it. To * list the managed policies that are attached to a group, use * ListAttachedGroupPolicies. For more information about policies, see Managed * policies and inline policies in the IAM User Guide.
You can
* paginate the results using the MaxItems
and Marker
* parameters. If there are no inline policies embedded with the specified group,
* the operation returns an empty list.