Class: AWS.IAM
- Inherits:
-
AWS.Service
- Object
- AWS.Service
- AWS.IAM
- Identifier:
- iam
- API Version:
- 2010-05-08
- Defined in:
- (unknown)
Overview
Constructs a service interface object. Each API operation is exposed as a function on service.
Service Description
Identity and Access Management (IAM) is a web service for securely controlling access to Amazon Web Services services. With IAM, you can centrally manage users, security credentials such as access keys, and permissions that control which Amazon Web Services resources users and applications can access. For more information about IAM, see Identity and Access Management (IAM) and the Identity and Access Management User Guide.
Sending a Request Using IAM
var iam = new AWS.IAM();
iam.addClientIDToOpenIDConnectProvider(params, function (err, data) {
if (err) console.log(err, err.stack); // an error occurred
else console.log(data); // successful response
});
Locking the API Version
In order to ensure that the IAM object uses this specific API, you can
construct the object by passing the apiVersion option to the constructor:
var iam = new AWS.IAM({apiVersion: '2010-05-08'});
You can also set the API version globally in AWS.config.apiVersions using
the iam service identifier:
AWS.config.apiVersions = {
iam: '2010-05-08',
// other service API versions
};
var iam = new AWS.IAM();
Waiter Resource States
This service supports a list of resource states that can be polled using the waitFor() method. The resource states are:
instanceProfileExists, userExists, roleExists, policyExists
Constructor Summary collapse
-
new AWS.IAM(options = {}) ⇒ Object
constructor
Constructs a service object.
Property Summary collapse
-
endpoint ⇒ AWS.Endpoint
readwrite
An Endpoint object representing the endpoint URL for service requests.
Properties inherited from AWS.Service
Method Summary collapse
-
addClientIDToOpenIDConnectProvider(params = {}, callback) ⇒ AWS.Request
Adds a new client ID (also known as audience) to the list of client IDs already registered for the specified IAM OpenID Connect (OIDC) provider resource.
This operation is idempotent; it does not fail or return an error if you add an existing client ID to the provider.
. -
addRoleToInstanceProfile(params = {}, callback) ⇒ AWS.Request
Adds the specified IAM role to the specified instance profile.
-
addUserToGroup(params = {}, callback) ⇒ AWS.Request
Adds the specified user to the specified group.
.
-
attachGroupPolicy(params = {}, callback) ⇒ AWS.Request
Attaches the specified managed policy to the specified IAM group.
You use this operation to attach a managed policy to a group.
-
attachRolePolicy(params = {}, callback) ⇒ AWS.Request
Attaches the specified managed policy to the specified IAM role.
-
attachUserPolicy(params = {}, callback) ⇒ AWS.Request
Attaches the specified managed policy to the specified user.
You use this operation to attach a managed policy to a user.
-
changePassword(params = {}, callback) ⇒ AWS.Request
Changes the password of the IAM user who is calling this operation.
-
createAccessKey(params = {}, callback) ⇒ AWS.Request
Creates a new Amazon Web Services secret access key and corresponding Amazon Web Services access key ID for the specified user.
-
createAccountAlias(params = {}, callback) ⇒ AWS.Request
Creates an alias for your Amazon Web Services account.
-
createGroup(params = {}, callback) ⇒ AWS.Request
Creates a new group.
For information about the number of groups you can create, see IAM and STS quotas in the IAM User Guide.
. -
createInstanceProfile(params = {}, callback) ⇒ AWS.Request
Creates a new instance profile.
-
createLoginProfile(params = {}, callback) ⇒ AWS.Request
Creates a password for the specified IAM user.
-
createOpenIDConnectProvider(params = {}, callback) ⇒ AWS.Request
Creates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC).
The OIDC provider that you create with this operation can be used as a principal in a role's trust policy.
-
createPolicy(params = {}, callback) ⇒ AWS.Request
Creates a new managed policy for your Amazon Web Services account.
This operation creates a policy version with a version identifier of
v1and sets v1 as the policy's default version. -
createPolicyVersion(params = {}, callback) ⇒ AWS.Request
Creates a new version of the specified managed policy.
-
createRole(params = {}, callback) ⇒ AWS.Request
Creates a new role for your Amazon Web Services account.
For more information about roles, see IAM roles in the IAM User Guide.
-
createSAMLProvider(params = {}, callback) ⇒ AWS.Request
Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.
The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy.
-
createServiceLinkedRole(params = {}, callback) ⇒ AWS.Request
Creates an IAM role that is linked to a specific Amazon Web Services service.
-
createServiceSpecificCredential(params = {}, callback) ⇒ AWS.Request
Generates a set of credentials consisting of a user name and password that can be used to access the service specified in the request.
-
createUser(params = {}, callback) ⇒ AWS.Request
Creates a new IAM user for your Amazon Web Services account.
For information about quotas for the number of IAM users you can create, see IAM and STS quotas in the IAM User Guide.
. -
createVirtualMFADevice(params = {}, callback) ⇒ AWS.Request
Creates a new virtual MFA device for the Amazon Web Services account.
-
deactivateMFADevice(params = {}, callback) ⇒ AWS.Request
Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled.
For more information about creating and working with virtual MFA devices, see Enabling a virtual multi-factor authentication (MFA) device in the IAM User Guide.
. -
deleteAccessKey(params = {}, callback) ⇒ AWS.Request
Deletes the access key pair associated with the specified IAM user.
If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request.
-
deleteAccountAlias(params = {}, callback) ⇒ AWS.Request
Deletes the specified Amazon Web Services account alias.
-
deleteAccountPasswordPolicy(params = {}, callback) ⇒ AWS.Request
Deletes the password policy for the Amazon Web Services account.
-
deleteGroup(params = {}, callback) ⇒ AWS.Request
Deletes the specified IAM group.
-
deleteGroupPolicy(params = {}, callback) ⇒ AWS.Request
Deletes the specified inline policy that is embedded in the specified IAM group.
A group can also have managed policies attached to it.
-
deleteInstanceProfile(params = {}, callback) ⇒ AWS.Request
Deletes the specified instance profile.
-
deleteLoginProfile(params = {}, callback) ⇒ AWS.Request
Deletes the password for the specified IAM user, For more information, see Managing passwords for IAM users.
You can use the CLI, the Amazon Web Services API, or the Users page in the IAM console to delete a password for any IAM user.
-
deleteOpenIDConnectProvider(params = {}, callback) ⇒ AWS.Request
Deletes an OpenID Connect identity provider (IdP) resource object in IAM.
Deleting an IAM OIDC provider resource does not update any roles that reference the provider as a principal in their trust policies.
-
deletePolicy(params = {}, callback) ⇒ AWS.Request
Deletes the specified managed policy.
Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to.
-
deletePolicyVersion(params = {}, callback) ⇒ AWS.Request
Deletes the specified version from the specified managed policy.
You cannot delete the default version from a policy using this operation.
-
deleteRole(params = {}, callback) ⇒ AWS.Request
Deletes the specified role.
-
deleteRolePermissionsBoundary(params = {}, callback) ⇒ AWS.Request
Deletes the permissions boundary for the specified IAM role.
-
deleteRolePolicy(params = {}, callback) ⇒ AWS.Request
Deletes the specified inline policy that is embedded in the specified IAM role.
A role can also have managed policies attached to it.
-
deleteSAMLProvider(params = {}, callback) ⇒ AWS.Request
Deletes a SAML provider resource in IAM.
Deleting the provider resource from IAM does not update any roles that reference the SAML provider resource's ARN as a principal in their trust policies.
-
deleteServerCertificate(params = {}, callback) ⇒ AWS.Request
Deletes the specified server certificate.
For more information about working with server certificates, see Working with server certificates in the IAM User Guide.
-
deleteServiceLinkedRole(params = {}, callback) ⇒ AWS.Request
Submits a service-linked role deletion request and returns a
DeletionTaskId, which you can use to check the status of the deletion. -
deleteServiceSpecificCredential(params = {}, callback) ⇒ AWS.Request
Deletes the specified service-specific credential.
.
-
deleteSigningCertificate(params = {}, callback) ⇒ AWS.Request
Deletes a signing certificate associated with the specified IAM user.
If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request.
-
deleteSSHPublicKey(params = {}, callback) ⇒ AWS.Request
Deletes the specified SSH public key.
The SSH public key deleted by this operation is used only for authenticating the associated IAM user to an CodeCommit repository.
-
deleteUser(params = {}, callback) ⇒ AWS.Request
Deletes the specified IAM user.
-
deleteUserPermissionsBoundary(params = {}, callback) ⇒ AWS.Request
Deletes the permissions boundary for the specified IAM user.
Deleting the permissions boundary for a user might increase its permissions by allowing the user to perform all the actions granted in its permissions policies.
-
deleteUserPolicy(params = {}, callback) ⇒ AWS.Request
Deletes the specified inline policy that is embedded in the specified IAM user.
A user can also have managed policies attached to it.
-
deleteVirtualMFADevice(params = {}, callback) ⇒ AWS.Request
Deletes a virtual MFA device.
Note: You must deactivate a user's virtual MFA device before you can delete it.- detachGroupPolicy(params = {}, callback) ⇒ AWS.Request
Removes the specified managed policy from the specified IAM group.
A group can also have inline policies embedded with it.
- detachRolePolicy(params = {}, callback) ⇒ AWS.Request
Removes the specified managed policy from the specified role.
A role can also have inline policies embedded with it.
- detachUserPolicy(params = {}, callback) ⇒ AWS.Request
Removes the specified managed policy from the specified user.
A user can also have inline policies embedded with it.
- enableMFADevice(params = {}, callback) ⇒ AWS.Request
Enables the specified MFA device and associates it with the specified IAM user.
- generateCredentialReport(params = {}, callback) ⇒ AWS.Request
Generates a credential report for the Amazon Web Services account.
- generateOrganizationsAccessReport(params = {}, callback) ⇒ AWS.Request
Generates a report for service last accessed data for Organizations.
- generateServiceLastAccessedDetails(params = {}, callback) ⇒ AWS.Request
Generates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access Amazon Web Services services.
- getAccessKeyLastUsed(params = {}, callback) ⇒ AWS.Request
Retrieves information about when the specified access key was last used.
- getAccountAuthorizationDetails(params = {}, callback) ⇒ AWS.Request
Retrieves information about all IAM users, groups, roles, and policies in your Amazon Web Services account, including their relationships to one another.
- getAccountPasswordPolicy(params = {}, callback) ⇒ AWS.Request
Retrieves the password policy for the Amazon Web Services account.
- getAccountSummary(params = {}, callback) ⇒ AWS.Request
Retrieves information about IAM entity usage and IAM quotas in the Amazon Web Services account.
For information about IAM quotas, see IAM and STS quotas in the IAM User Guide.
.- getContextKeysForCustomPolicy(params = {}, callback) ⇒ AWS.Request
Gets a list of all of the context keys referenced in the input policies.
- getContextKeysForPrincipalPolicy(params = {}, callback) ⇒ AWS.Request
Gets a list of all of the context keys referenced in all the IAM policies that are attached to the specified IAM entity.
- getCredentialReport(params = {}, callback) ⇒ AWS.Request
Retrieves a credential report for the Amazon Web Services account.
- getGroup(params = {}, callback) ⇒ AWS.Request
Returns a list of IAM users that are in the specified IAM group.
- getGroupPolicy(params = {}, callback) ⇒ AWS.Request
Retrieves the specified inline policy document that is embedded in the specified IAM group.
Note: Policies returned by this operation are URL-encoded compliant with RFC 3986.- getInstanceProfile(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role.
- getLoginProfile(params = {}, callback) ⇒ AWS.Request
Retrieves the user name for the specified IAM user.
- getMFADevice(params = {}, callback) ⇒ AWS.Request
Retrieves information about an MFA device for a specified user.
.
- getOpenIDConnectProvider(params = {}, callback) ⇒ AWS.Request
Returns information about the specified OpenID Connect (OIDC) provider resource object in IAM.
.
- getOrganizationsAccessReport(params = {}, callback) ⇒ AWS.Request
Retrieves the service last accessed data report for Organizations that was previously generated using the
GenerateOrganizationsAccessReportoperation.- getPolicy(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached.
- getPolicyVersion(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified version of the specified managed policy, including the policy document.
Note: Policies returned by this operation are URL-encoded compliant with RFC 3986.- getRole(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role.
- getRolePolicy(params = {}, callback) ⇒ AWS.Request
Retrieves the specified inline policy document that is embedded with the specified IAM role.
Note: Policies returned by this operation are URL-encoded compliant with RFC 3986.- getSAMLProvider(params = {}, callback) ⇒ AWS.Request
Returns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated.
Note: This operation requires Signature Version 4.- getServerCertificate(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified server certificate stored in IAM.
For more information about working with server certificates, see Working with server certificates in the IAM User Guide.
- getServiceLastAccessedDetails(params = {}, callback) ⇒ AWS.Request
Retrieves a service last accessed report that was created using the
GenerateServiceLastAccessedDetailsoperation.- getServiceLastAccessedDetailsWithEntities(params = {}, callback) ⇒ AWS.Request
After you generate a group or policy report using the
GenerateServiceLastAccessedDetailsoperation, you can use theJobIdparameter inGetServiceLastAccessedDetailsWithEntities.- getServiceLinkedRoleDeletionStatus(params = {}, callback) ⇒ AWS.Request
Retrieves the status of your service-linked role deletion.
- getSSHPublicKey(params = {}, callback) ⇒ AWS.Request
Retrieves the specified SSH public key, including metadata about the key.
The SSH public key retrieved by this operation is used only for authenticating the associated IAM user to an CodeCommit repository.
- getUser(params = {}, callback) ⇒ AWS.Request
Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.
If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID used to sign the request to this operation.
.- getUserPolicy(params = {}, callback) ⇒ AWS.Request
Retrieves the specified inline policy document that is embedded in the specified IAM user.
Note: Policies returned by this operation are URL-encoded compliant with RFC 3986.- listAccessKeys(params = {}, callback) ⇒ AWS.Request
Returns information about the access key IDs associated with the specified IAM user.
- listAccountAliases(params = {}, callback) ⇒ AWS.Request
Lists the account alias associated with the Amazon Web Services account (Note: you can have only one).
- listAttachedGroupPolicies(params = {}, callback) ⇒ AWS.Request
Lists all managed policies that are attached to the specified IAM group.
An IAM group can also have inline policies embedded with it.
- listAttachedRolePolicies(params = {}, callback) ⇒ AWS.Request
Lists all managed policies that are attached to the specified IAM role.
An IAM role can also have inline policies embedded with it.
- listAttachedUserPolicies(params = {}, callback) ⇒ AWS.Request
Lists all managed policies that are attached to the specified IAM user.
An IAM user can also have inline policies embedded with it.
- listEntitiesForPolicy(params = {}, callback) ⇒ AWS.Request
Lists all IAM users, groups, and roles that the specified managed policy is attached to.
You can use the optional
EntityFilterparameter to limit the results to a particular type of entity (users, groups, or roles).- listGroupPolicies(params = {}, callback) ⇒ AWS.Request
Lists the names of the inline policies that are embedded in the specified IAM group.
An IAM group can also have managed policies attached to it.
- listGroups(params = {}, callback) ⇒ AWS.Request
Lists the IAM groups that have the specified path prefix.
You can paginate the results using the
.MaxItemsandMarkerparameters.- listGroupsForUser(params = {}, callback) ⇒ AWS.Request
Lists the IAM groups that the specified IAM user belongs to.
You can paginate the results using the
.MaxItemsandMarkerparameters.- listInstanceProfiles(params = {}, callback) ⇒ AWS.Request
Lists the instance profiles that have the specified path prefix.
- listInstanceProfilesForRole(params = {}, callback) ⇒ AWS.Request
Lists the instance profiles that have the specified associated IAM role.
- listInstanceProfileTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified IAM instance profile.
- listMFADevices(params = {}, callback) ⇒ AWS.Request
Lists the MFA devices for an IAM user.
- listMFADeviceTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified IAM virtual multi-factor authentication (MFA) device.
- listOpenIDConnectProviders(params = {}, callback) ⇒ AWS.Request
Lists information about the IAM OpenID Connect (OIDC) provider resource objects defined in the Amazon Web Services account.
Note: IAM resource-listing operations return a subset of the available attributes for the resource.- listOpenIDConnectProviderTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified OpenID Connect (OIDC)-compatible identity provider.
- listPolicies(params = {}, callback) ⇒ AWS.Request
Lists all the managed policies that are available in your Amazon Web Services account, including your own customer-defined managed policies and all Amazon Web Services managed policies.
You can filter the list of policies that is returned using the optional
OnlyAttached,Scope, andPathPrefixparameters.- listPoliciesGrantingServiceAccess(params = {}, callback) ⇒ AWS.Request
Retrieves a list of policies that the IAM identity (user, group, or role) can use to access each specified service.
Note: This operation does not use other policy types when determining whether a resource could access a service.- listPolicyTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified IAM customer managed policy.
- listPolicyVersions(params = {}, callback) ⇒ AWS.Request
Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.
For more information about managed policies, see Managed policies and inline policies in the IAM User Guide.
.- listRolePolicies(params = {}, callback) ⇒ AWS.Request
Lists the names of the inline policies that are embedded in the specified IAM role.
An IAM role can also have managed policies attached to it.
- listRoles(params = {}, callback) ⇒ AWS.Request
Lists the IAM roles that have the specified path prefix.
- listRoleTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified role.
- listSAMLProviders(params = {}, callback) ⇒ AWS.Request
Lists the SAML provider resource objects defined in IAM in the account.
- listSAMLProviderTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified Security Assertion Markup Language (SAML) identity provider.
- listServerCertificates(params = {}, callback) ⇒ AWS.Request
Lists the server certificates stored in IAM that have the specified path prefix.
- listServerCertificateTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified IAM server certificate.
- listServiceSpecificCredentials(params = {}, callback) ⇒ AWS.Request
Returns information about the service-specific credentials associated with the specified IAM user.
- listSigningCertificates(params = {}, callback) ⇒ AWS.Request
Returns information about the signing certificates associated with the specified IAM user.
- listSSHPublicKeys(params = {}, callback) ⇒ AWS.Request
Returns information about the SSH public keys associated with the specified IAM user.
- listUserPolicies(params = {}, callback) ⇒ AWS.Request
Lists the names of the inline policies embedded in the specified IAM user.
An IAM user can also have managed policies attached to it.
- listUsers(params = {}, callback) ⇒ AWS.Request
Lists the IAM users that have the specified path prefix.
- listUserTags(params = {}, callback) ⇒ AWS.Request
Lists the tags that are attached to the specified IAM user.
- listVirtualMFADevices(params = {}, callback) ⇒ AWS.Request
Lists the virtual MFA devices defined in the Amazon Web Services account by assignment status.
- putGroupPolicy(params = {}, callback) ⇒ AWS.Request
Adds or updates an inline policy document that is embedded in the specified IAM group.
A user can also have managed policies attached to it.
- putRolePermissionsBoundary(params = {}, callback) ⇒ AWS.Request
Adds or updates the policy that is specified as the IAM role's permissions boundary.
- putRolePolicy(params = {}, callback) ⇒ AWS.Request
Adds or updates an inline policy document that is embedded in the specified IAM role.
When you embed an inline policy in a role, the inline policy is used as part of the role's access (permissions) policy.
- putUserPermissionsBoundary(params = {}, callback) ⇒ AWS.Request
Adds or updates the policy that is specified as the IAM user's permissions boundary.
- putUserPolicy(params = {}, callback) ⇒ AWS.Request
Adds or updates an inline policy document that is embedded in the specified IAM user.
An IAM user can also have a managed policy attached to it.
- removeClientIDFromOpenIDConnectProvider(params = {}, callback) ⇒ AWS.Request
Removes the specified client ID (also known as audience) from the list of client IDs registered for the specified IAM OpenID Connect (OIDC) provider resource object.
This operation is idempotent; it does not fail or return an error if you try to remove a client ID that does not exist.
.- removeRoleFromInstanceProfile(params = {}, callback) ⇒ AWS.Request
Removes the specified IAM role from the specified Amazon EC2 instance profile.
Make sure that you do not have any Amazon EC2 instances running with the role you are about to remove from the instance profile.
- removeUserFromGroup(params = {}, callback) ⇒ AWS.Request
Removes the specified user from the specified group.
.
- resetServiceSpecificCredential(params = {}, callback) ⇒ AWS.Request
Resets the password for a service-specific credential.
- resyncMFADevice(params = {}, callback) ⇒ AWS.Request
Synchronizes the specified MFA device with its IAM resource object on the Amazon Web Services servers.
For more information about creating and working with virtual MFA devices, see Using a virtual MFA device in the IAM User Guide.
.- setDefaultPolicyVersion(params = {}, callback) ⇒ AWS.Request
Sets the specified version of the specified policy as the policy's default (operative) version.
This operation affects all users, groups, and roles that the policy is attached to.
- setSecurityTokenServicePreferences(params = {}, callback) ⇒ AWS.Request
Sets the specified version of the global endpoint token as the token version used for the Amazon Web Services account.
By default, Security Token Service (STS) is available as a global service, and all STS requests go to a single endpoint at
https://sts.amazonaws.com.- simulateCustomPolicy(params = {}, callback) ⇒ AWS.Request
Simulate how a set of IAM policies and optionally a resource-based policy works with a list of API operations and Amazon Web Services resources to determine the policies' effective permissions.
- simulatePrincipalPolicy(params = {}, callback) ⇒ AWS.Request
Simulate how a set of IAM policies attached to an IAM entity works with a list of API operations and Amazon Web Services resources to determine the policies' effective permissions.
- tagInstanceProfile(params = {}, callback) ⇒ AWS.Request
Adds one or more tags to an IAM instance profile.
- tagMFADevice(params = {}, callback) ⇒ AWS.Request
Adds one or more tags to an IAM virtual multi-factor authentication (MFA) device.
- detachGroupPolicy(params = {}, callback) ⇒ AWS.Request