Class: Aws::IAM::Client

# The following command adds the role named S3Access to the instance profile named Webserver:

resp = client.add_role_to_instance_profile({
  instance_profile_name: "Webserver", 
  role_name: "S3Access", 
})

resp = client.add_role_to_instance_profile({
  instance_profile_name: "instanceProfileNameType", # required
  role_name: "roleNameType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :instance_profile_name (required, String) —

  The name of the instance profile to update.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :role_name (required, String) —

  The name of the role to add.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command adds an IAM user named Bob to the IAM group named Admins:

resp = client.add_user_to_group({
  group_name: "Admins", 
  user_name: "Bob", 
})

resp = client.add_user_to_group({
  group_name: "groupNameType", # required
  user_name: "existingUserNameType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :group_name (required, String) —

  The name of the group to update.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :user_name (required, String) —

  The name of the user to add.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command attaches the AWS managed policy named ReadOnlyAccess to the IAM group named Finance.

resp = client.attach_group_policy({
  group_name: "Finance", 
  policy_arn: "arn:aws:iam::aws:policy/ReadOnlyAccess", 
})

resp = client.attach_group_policy({
  group_name: "groupNameType", # required
  policy_arn: "arnType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :group_name (required, String) —

  The name (friendly name, not ARN) of the group to attach the policy to.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :policy_arn (required, String) —

  The Amazon Resource Name (ARN) of the IAM policy you want to attach.

  For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command attaches the AWS managed policy named ReadOnlyAccess to the IAM role named ReadOnlyRole.

resp = client.attach_role_policy({
  policy_arn: "arn:aws:iam::aws:policy/ReadOnlyAccess", 
  role_name: "ReadOnlyRole", 
})

resp = client.attach_role_policy({
  role_name: "roleNameType", # required
  policy_arn: "arnType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :role_name (required, String) —

  The name (friendly name, not ARN) of the role to attach the policy to.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :policy_arn (required, String) —

  The Amazon Resource Name (ARN) of the IAM policy you want to attach.

  For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command attaches the AWS managed policy named AdministratorAccess to the IAM user named Alice.

resp = client.attach_user_policy({
  policy_arn: "arn:aws:iam::aws:policy/AdministratorAccess", 
  user_name: "Alice", 
})

resp = client.attach_user_policy({
  user_name: "userNameType", # required
  policy_arn: "arnType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :user_name (required, String) —

  The name (friendly name, not ARN) of the IAM user to attach the policy to.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :policy_arn (required, String) —

  The Amazon Resource Name (ARN) of the IAM policy you want to attach.

  For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command changes the password for the current IAM user.

resp = client.change_password({
  new_password: "]35d/{pB9Fo9wJ", 
  old_password: "3s0K_;xh4~8XXI", 
})

resp = client.change_password({
  old_password: "passwordType", # required
  new_password: "passwordType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :old_password (required, String) —

  The IAM user's current password.

• :new_password (required, String) —

  The new password. The new password must conform to the Amazon Web Services account's password policy, if one exists.

  The regex pattern that is used to validate this parameter is a string of characters. That string can include almost any printable ASCII character from the space (\u0020) through the end of the ASCII character range (\u00FF). You can also include the tab (\u0009), line feed (\u000A), and carriage return (\u000D) characters. Any of these characters are valid in a password. However, many tools, such as the Amazon Web Services Management Console, might restrict the ability to type certain characters because they have special meaning within that tool.

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command creates an access key (access key ID and secret access key) for the IAM user named Bob.

resp = client.create_access_key({
  user_name: "Bob", 
})
resp.to_h outputs the following:
{
  access_key: {
    access_key_id: "AKIAIOSFODNN7EXAMPLE", 
    create_date: Time.parse("2015-03-09T18:39:23.411Z"), 
    secret_access_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY", 
    status: "Active", 
    user_name: "Bob", 
  }, 
}

resp = client.create_access_key({
  user_name: "existingUserNameType",
})

resp.access_key.user_name #=> String
resp.access_key.access_key_id #=> String
resp.access_key.status #=> String, one of "Active", "Inactive", "Expired"
resp.access_key.secret_access_key #=> String
resp.access_key.create_date #=> Time

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :user_name (String) —

  The name of the IAM user that the new key will belong to.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Returns:

• (Types::CreateAccessKeyResponse) —

  Returns a response object which responds to the following methods:

  • #access_key => Types::AccessKey

See Also:

• AWS API Documentation

# The following command associates the alias examplecorp to your AWS account.

resp = client.create_account_alias({
  account_alias: "examplecorp", 
})

resp = client.create_account_alias({
  account_alias: "accountAliasType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :account_alias (required, String) —

  The account alias to create.

  This parameter allows (through its regex pattern) a string of characters consisting of lowercase letters, digits, and dashes. You cannot start or finish with a dash, nor can you have two dashes in a row.

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command creates an IAM group named Admins.

resp = client.create_group({
  group_name: "Admins", 
})
resp.to_h outputs the following:
{
  group: {
    arn: "arn:aws:iam::123456789012:group/Admins", 
    create_date: Time.parse("2015-03-09T20:30:24.940Z"), 
    group_id: "AIDGPMS9RO4H3FEXAMPLE", 
    group_name: "Admins", 
    path: "/", 
  }, 
}

resp = client.create_group({
  path: "pathType",
  group_name: "groupNameType", # required
})

resp.group.path #=> String
resp.group.group_name #=> String
resp.group.group_id #=> String
resp.group.arn #=> String
resp.group.create_date #=> Time

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :path (String) —

  The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

• :group_name (required, String) —

  The name of the group to create. Do not include the path in this value.

  IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".

Returns:

• (Types::CreateGroupResponse) —

  Returns a response object which responds to the following methods:

  • #group => Types::Group

See Also:

• AWS API Documentation

# The following command creates an instance profile named Webserver that is ready to have a role attached and then be
# associated with an EC2 instance.

resp = client.create_instance_profile({
  instance_profile_name: "Webserver", 
})
resp.to_h outputs the following:
{
  instance_profile: {
    arn: "arn:aws:iam::123456789012:instance-profile/Webserver", 
    create_date: Time.parse("2015-03-09T20:33:19.626Z"), 
    instance_profile_id: "AIPAJMBYC7DLSPEXAMPLE", 
    instance_profile_name: "Webserver", 
    path: "/", 
    roles: [
    ], 
  }, 
}

resp = client.create_instance_profile({
  instance_profile_name: "instanceProfileNameType", # required
  path: "pathType",
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.instance_profile.path #=> String
resp.instance_profile.instance_profile_name #=> String
resp.instance_profile.instance_profile_id #=> String
resp.instance_profile.arn #=> String
resp.instance_profile.create_date #=> Time
resp.instance_profile.roles #=> Array
resp.instance_profile.roles[0].path #=> String
resp.instance_profile.roles[0].role_name #=> String
resp.instance_profile.roles[0].role_id #=> String
resp.instance_profile.roles[0].arn #=> String
resp.instance_profile.roles[0].create_date #=> Time
resp.instance_profile.roles[0].assume_role_policy_document #=> String
resp.instance_profile.roles[0].description #=> String
resp.instance_profile.roles[0].max_session_duration #=> Integer
resp.instance_profile.roles[0].permissions_boundary.permissions_boundary_type #=> String, one of "PermissionsBoundaryPolicy"
resp.instance_profile.roles[0].permissions_boundary.permissions_boundary_arn #=> String
resp.instance_profile.roles[0].tags #=> Array
resp.instance_profile.roles[0].tags[0].key #=> String
resp.instance_profile.roles[0].tags[0].value #=> String
resp.instance_profile.roles[0].role_last_used.last_used_date #=> Time
resp.instance_profile.roles[0].role_last_used.region #=> String
resp.instance_profile.tags #=> Array
resp.instance_profile.tags[0].key #=> String
resp.instance_profile.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :instance_profile_name (required, String) —

  The name of the instance profile to create.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :path (String) —

  The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the newly created IAM instance profile. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreateInstanceProfileResponse) —

  Returns a response object which responds to the following methods:

  • #instance_profile => Types::InstanceProfile

See Also:

• AWS API Documentation

# The following command changes IAM user Bob's password and sets the flag that required Bob to change the password the
# next time he signs in.

resp = client.create_login_profile({
  password: "h]6EszR}vJ*m", 
  password_reset_required: true, 
  user_name: "Bob", 
})
resp.to_h outputs the following:
{
  login_profile: {
    create_date: Time.parse("2015-03-10T20:55:40.274Z"), 
    password_reset_required: true, 
    user_name: "Bob", 
  }, 
}

resp = client.create_login_profile({
  user_name: "userNameType",
  password: "passwordType",
  password_reset_required: false,
})

resp.login_profile.user_name #=> String
resp.login_profile.create_date #=> Time
resp.login_profile.password_reset_required #=> Boolean

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :user_name (String) —

  The name of the IAM user to create a password for. The user must already exist.

  This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :password (String) —

  The new password for the user.

  This parameter must be omitted when you make the request with an AssumeRoot session. It is required in all other cases.

  The regex pattern that is used to validate this parameter is a string of characters. That string can include almost any printable ASCII character from the space (\u0020) through the end of the ASCII character range (\u00FF). You can also include the tab (\u0009), line feed (\u000A), and carriage return (\u000D) characters. Any of these characters are valid in a password. However, many tools, such as the Amazon Web Services Management Console, might restrict the ability to type certain characters because they have special meaning within that tool.

• :password_reset_required (Boolean) —

  Specifies whether the user is required to set a new password on next sign-in.

Returns:

• (Types::CreateLoginProfileResponse) —

  Returns a response object which responds to the following methods:

  • #login_profile => Types::LoginProfile

See Also:

• AWS API Documentation

# The following example defines a new OIDC provider in IAM with a client ID of my-application-id and pointing at the
# server with a URL of https://server.example.com.

resp = client.create_open_id_connect_provider({
  client_id_list: [
    "my-application-id", 
  ], 
  thumbprint_list: [
    "3768084dfb3d2b68b7897bf5f565da8efEXAMPLE", 
  ], 
  url: "https://server.example.com", 
})
resp.to_h outputs the following:
{
  open_id_connect_provider_arn: "arn:aws:iam::123456789012:oidc-provider/server.example.com", 
}

resp = client.create_open_id_connect_provider({
  url: "OpenIDConnectProviderUrlType", # required
  client_id_list: ["clientIDType"],
  thumbprint_list: ["thumbprintType"],
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.open_id_connect_provider_arn #=> String
resp.tags #=> Array
resp.tags[0].key #=> String
resp.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :url (required, String) —

  The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com. The URL should not contain a port number.

  You cannot register the same provider multiple times in a single Amazon Web Services account. If you try to submit a URL that has already been used for an OpenID Connect provider in the Amazon Web Services account, you will get an error.

• :client_id_list (Array<String>) —

  Provides a list of client IDs, also known as audiences. When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. This is the value that's sent as the client_id parameter on OAuth requests.

  You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider.

  There is no defined format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 characters long.

• :thumbprint_list (Array<String>) —

  A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. Typically this list includes only one entry. However, IAM lets you have up to five thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certificates.

  This parameter is optional. If it is not included, IAM will retrieve and use the top intermediate certificate authority (CA) thumbprint of the OpenID Connect identity provider server certificate.

  The server certificate thumbprint is the hex-encoded SHA-1 hash value of the X.509 certificate used by the domain where the OpenID Connect provider makes its keys available. It is always a 40-character string.

  For example, assume that the OIDC provider is server.example.com and the provider stores its keys at https://keys.server.example.com/openid-connect. In that case, the thumbprint string would be the hex-encoded SHA-1 hash value of the certificate used by https://keys.server.example.com.

  For more information about obtaining the OIDC provider thumbprint, see Obtaining the thumbprint for an OpenID Connect provider in the IAM user Guide.

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new IAM OpenID Connect (OIDC) provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreateOpenIDConnectProviderResponse) —

  Returns a response object which responds to the following methods:

  • #open_id_connect_provider_arn => String
  • #tags => Array<Types::Tag>

See Also:

• AWS API Documentation

resp = client.create_policy({
  policy_name: "policyNameType", # required
  path: "policyPathType",
  policy_document: "policyDocumentType", # required
  description: "policyDescriptionType",
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.policy.policy_name #=> String
resp.policy.policy_id #=> String
resp.policy.arn #=> String
resp.policy.path #=> String
resp.policy.default_version_id #=> String
resp.policy.attachment_count #=> Integer
resp.policy.permissions_boundary_usage_count #=> Integer
resp.policy.is_attachable #=> Boolean
resp.policy.description #=> String
resp.policy.create_date #=> Time
resp.policy.update_date #=> Time
resp.policy.tags #=> Array
resp.policy.tags[0].key #=> String
resp.policy.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :policy_name (required, String) —

  The friendly name of the policy.

  IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".

• :path (String) —

  The path for the policy.

  For more information about paths, see IAM identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

  You cannot use an asterisk (*) in the path name.

• :policy_document (required, String) —

  The JSON policy document that you want to use as the content for the new policy.

  You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.

  The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.

  To learn more about JSON policy grammar, see Grammar of the IAM JSON policy language in the IAM User Guide.

  The regex pattern used to validate this parameter is a string of characters consisting of the following:

  • Any printable ASCII character ranging from the space character (\u0020) through the end of the ASCII character range

  • The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF)

  • The special characters tab (\u0009), line feed (\u000A), and carriage return (\u000D)

• :description (String) —

  A friendly description of the policy.

  Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables."

  The policy description is immutable. After a value is assigned, it cannot be changed.

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new IAM customer managed policy. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreatePolicyResponse) —

  Returns a response object which responds to the following methods:

  • #policy => Types::Policy

See Also:

• AWS API Documentation

resp = client.create_policy_version({
  policy_arn: "arnType", # required
  policy_document: "policyDocumentType", # required
  set_as_default: false,
})

resp.policy_version.document #=> String
resp.policy_version.version_id #=> String
resp.policy_version.is_default_version #=> Boolean
resp.policy_version.create_date #=> Time

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :policy_arn (required, String) —

  The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version.

  For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

• :policy_document (required, String) —

  The JSON policy document that you want to use as the content for this new version of the policy.

  You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.

  The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.

  The regex pattern used to validate this parameter is a string of characters consisting of the following:

  • Any printable ASCII character ranging from the space character (\u0020) through the end of the ASCII character range

  • The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF)

  • The special characters tab (\u0009), line feed (\u000A), and carriage return (\u000D)

• :set_as_default (Boolean) —

  Specifies whether to set this version as the policy's default version.

  When this parameter is true, the new policy version becomes the operative version. That is, it becomes the version that is in effect for the IAM users, groups, and roles that the policy is attached to.

  For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.

Returns:

• (Types::CreatePolicyVersionResponse) —

  Returns a response object which responds to the following methods:

  • #policy_version => Types::PolicyVersion

See Also:

• AWS API Documentation

# The following command creates a role named Test-Role and attaches a trust policy that you must convert from JSON to a
# string. Upon success, the response includes the same policy as a URL-encoded JSON string.

resp = client.create_role({
  assume_role_policy_document: "<Stringified-JSON>", 
  path: "/", 
  role_name: "Test-Role", 
})
resp.to_h outputs the following:
{
  role: {
    arn: "arn:aws:iam::123456789012:role/Test-Role", 
    assume_role_policy_document: "<URL-encoded-JSON>", 
    create_date: Time.parse("2013-06-07T20:43:32.821Z"), 
    path: "/", 
    role_id: "AKIAIOSFODNN7EXAMPLE", 
    role_name: "Test-Role", 
  }, 
}

resp = client.create_role({
  path: "pathType",
  role_name: "roleNameType", # required
  assume_role_policy_document: "policyDocumentType", # required
  description: "roleDescriptionType",
  max_session_duration: 1,
  permissions_boundary: "arnType",
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.role.path #=> String
resp.role.role_name #=> String
resp.role.role_id #=> String
resp.role.arn #=> String
resp.role.create_date #=> Time
resp.role.assume_role_policy_document #=> String
resp.role.description #=> String
resp.role.max_session_duration #=> Integer
resp.role.permissions_boundary.permissions_boundary_type #=> String, one of "PermissionsBoundaryPolicy"
resp.role.permissions_boundary.permissions_boundary_arn #=> String
resp.role.tags #=> Array
resp.role.tags[0].key #=> String
resp.role.tags[0].value #=> String
resp.role.role_last_used.last_used_date #=> Time
resp.role.role_last_used.region #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :path (String) —

  The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

• :role_name (required, String) —

  The name of the role to create.

  IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :assume_role_policy_document (required, String) —

  The trust relationship policy document that grants an entity permission to assume the role.

  In IAM, you must provide a JSON policy that has been converted to a string. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.

  The regex pattern used to validate this parameter is a string of characters consisting of the following:

  • Any printable ASCII character ranging from the space character (\u0020) through the end of the ASCII character range

  • The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF)

  • The special characters tab (\u0009), line feed (\u000A), and carriage return (\u000D)

  Upon success, the response includes the same trust policy in JSON format.

• :description (String) —

  A description of the role.

• :max_session_duration (Integer) —

  The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.

  Anyone who assumes the role from the CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM roles in the IAM User Guide.

• :permissions_boundary (String) —

  The ARN of the managed policy that is used to set the permissions boundary for the role.

  A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.

  For more information about policy types, see Policy types in the IAM User Guide.

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new role. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreateRoleResponse) —

  Returns a response object which responds to the following methods:

  • #role => Types::Role

See Also:

• AWS API Documentation

resp = client.create_saml_provider({
  saml_metadata_document: "SAMLMetadataDocumentType", # required
  name: "SAMLProviderNameType", # required
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
  assertion_encryption_mode: "Required", # accepts Required, Allowed
  add_private_key: "privateKeyType",
})

resp.saml_provider_arn #=> String
resp.tags #=> Array
resp.tags[0].key #=> String
resp.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :saml_metadata_document (required, String) —

  An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP.

  For more information, see About SAML 2.0-based federation in the IAM User Guide

• :name (required, String) —

  The name of the provider to create.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

• :assertion_encryption_mode (String) —

  Specifies the encryption setting for the SAML provider.

• :add_private_key (String) —

  The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.

Returns:

• (Types::CreateSAMLProviderResponse) —

  Returns a response object which responds to the following methods:

  • #saml_provider_arn => String
  • #tags => Array<Types::Tag>

See Also:

• AWS API Documentation

resp = client.create_service_linked_role({
  aws_service_name: "groupNameType", # required
  description: "roleDescriptionType",
  custom_suffix: "customSuffixType",
})

resp.role.path #=> String
resp.role.role_name #=> String
resp.role.role_id #=> String
resp.role.arn #=> String
resp.role.create_date #=> Time
resp.role.assume_role_policy_document #=> String
resp.role.description #=> String
resp.role.max_session_duration #=> Integer
resp.role.permissions_boundary.permissions_boundary_type #=> String, one of "PermissionsBoundaryPolicy"
resp.role.permissions_boundary.permissions_boundary_arn #=> String
resp.role.tags #=> Array
resp.role.tags[0].key #=> String
resp.role.tags[0].value #=> String
resp.role.role_last_used.last_used_date #=> Time
resp.role.role_last_used.region #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :aws_service_name (required, String) —

  The service principal for the Amazon Web Services service to which this role is attached. You use a string similar to a URL but without the https:// in front. For example: elasticbeanstalk.amazonaws.com.

  Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see Amazon Web Services services that work with IAM in the IAM User Guide. Look for the services that have Yes in the Service-Linked Role column. Choose the Yes link to view the service-linked role documentation for that service.

• :description (String) —

  The description of the role.

• :custom_suffix (String) —

  A string that you provide, which is combined with the service-provided prefix to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.

  Some services do not support the CustomSuffix parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix.

Returns:

• (Types::CreateServiceLinkedRoleResponse) —

  Returns a response object which responds to the following methods:

  • #role => Types::Role

See Also:

• AWS API Documentation

resp = client.create_service_specific_credential({
  user_name: "userNameType", # required
  service_name: "serviceName", # required
  credential_age_days: 1,
})

resp.service_specific_credential.create_date #=> Time
resp.service_specific_credential.expiration_date #=> Time
resp.service_specific_credential.service_name #=> String
resp.service_specific_credential.service_user_name #=> String
resp.service_specific_credential.service_password #=> String
resp.service_specific_credential.service_credential_alias #=> String
resp.service_specific_credential.service_credential_secret #=> String
resp.service_specific_credential.service_specific_credential_id #=> String
resp.service_specific_credential.user_name #=> String
resp.service_specific_credential.status #=> String, one of "Active", "Inactive", "Expired"

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :user_name (required, String) —

  The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :service_name (required, String) —

  The name of the Amazon Web Services service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.

• :credential_age_days (Integer) —

  The number of days until the service specific credential expires. This field is only valid for Bedrock API keys and must be a positive integer. When not specified, the credential will not expire.

Returns:

• (Types::CreateServiceSpecificCredentialResponse) —

  Returns a response object which responds to the following methods:

  • #service_specific_credential => Types::ServiceSpecificCredential

See Also:

• AWS API Documentation

# The following create-user command creates an IAM user named Bob in the current account.

resp = client.create_user({
  user_name: "Bob", 
})
resp.to_h outputs the following:
{
  user: {
    arn: "arn:aws:iam::123456789012:user/Bob", 
    create_date: Time.parse("2013-06-08T03:20:41.270Z"), 
    path: "/", 
    user_id: "AKIAIOSFODNN7EXAMPLE", 
    user_name: "Bob", 
  }, 
}

resp = client.create_user({
  path: "pathType",
  user_name: "userNameType", # required
  permissions_boundary: "arnType",
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.user.path #=> String
resp.user.user_name #=> String
resp.user.user_id #=> String
resp.user.arn #=> String
resp.user.create_date #=> Time
resp.user.password_last_used #=> Time
resp.user.permissions_boundary.permissions_boundary_type #=> String, one of "PermissionsBoundaryPolicy"
resp.user.permissions_boundary.permissions_boundary_arn #=> String
resp.user.tags #=> Array
resp.user.tags[0].key #=> String
resp.user.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :path (String) —

  The path for the user name. For more information about paths, see IAM identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

• :user_name (required, String) —

  The name of the user to create.

  IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".

• :permissions_boundary (String) —

  The ARN of the managed policy that is used to set the permissions boundary for the user.

  A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.

  For more information about policy types, see Policy types in the IAM User Guide.

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new user. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreateUserResponse) —

  Returns a response object which responds to the following methods:

  • #user => Types::User

See Also:

• AWS API Documentation

resp = client.create_virtual_mfa_device({
  path: "pathType",
  virtual_mfa_device_name: "virtualMFADeviceName", # required
  tags: [
    {
      key: "tagKeyType", # required
      value: "tagValueType", # required
    },
  ],
})

resp.virtual_mfa_device.serial_number #=> String
resp.virtual_mfa_device.base_32_string_seed #=> String
resp.virtual_mfa_device.qr_code_png #=> String
resp.virtual_mfa_device.user.path #=> String
resp.virtual_mfa_device.user.user_name #=> String
resp.virtual_mfa_device.user.user_id #=> String
resp.virtual_mfa_device.user.arn #=> String
resp.virtual_mfa_device.user.create_date #=> Time
resp.virtual_mfa_device.user.password_last_used #=> Time
resp.virtual_mfa_device.user.permissions_boundary.permissions_boundary_type #=> String, one of "PermissionsBoundaryPolicy"
resp.virtual_mfa_device.user.permissions_boundary.permissions_boundary_arn #=> String
resp.virtual_mfa_device.user.tags #=> Array
resp.virtual_mfa_device.user.tags[0].key #=> String
resp.virtual_mfa_device.user.tags[0].value #=> String
resp.virtual_mfa_device.enable_date #=> Time
resp.virtual_mfa_device.tags #=> Array
resp.virtual_mfa_device.tags[0].key #=> String
resp.virtual_mfa_device.tags[0].value #=> String

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :path (String) —

  The path for the virtual MFA device. For more information about paths, see IAM identifiers in the IAM User Guide.

  This parameter is optional. If it is not included, it defaults to a slash (/).

  This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

• :virtual_mfa_device_name (required, String) —

  The name of the virtual MFA device, which must be unique. Use with path to uniquely identify a virtual MFA device.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :tags (Array<Types::Tag>) —

  A list of tags that you want to attach to the new IAM virtual MFA device. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

  If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Returns:

• (Types::CreateVirtualMFADeviceResponse) —

  Returns a response object which responds to the following methods:

  • #virtual_mfa_device => Types::VirtualMFADevice

See Also:

• AWS API Documentation

resp = client.deactivate_mfa_device({
  user_name: "existingUserNameType",
  serial_number: "serialNumberType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})

Options Hash (params):

• :user_name (String) —

  The name of the user whose MFA device you want to deactivate.

  This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

• :serial_number (required, String) —

  The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.

  This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@:/-

Returns:

• (Struct) —

  Returns an empty response.

See Also:

• AWS API Documentation

# The following command deletes one access key (access key ID and secret access key) assigned to the IAM user named Bob.

resp = client.delete_access_key({
  access_key_id: "AKIDPMS9RO4H3FEXAMPLE", 
  user_name: "Bob", 
})

resp = client.delete_access_key({
  user_name: "existingUserNameType",
  access_key_id: "accessKeyIdType", # required
})

Parameters:

• params (Hash) (defaults to: {}) —

  ({})