There are more AWS SDK examples available in the [AWS Doc SDK Examples](https://github.com/awsdocs/aws-doc-sdk-examples) GitHub repo.
# Actions for IAM using AWS SDKs
The following code examples demonstrate how to perform individual IAM actions with AWS SDKs. Each example includes a link to GitHub, where you can find instructions for setting up and running the code.
These excerpts call the IAM API and are code excerpts from larger programs that must be run in context. You can see actions in context in [Scenarios for IAM using AWS SDKs](iam_code_examples_scenarios.md).
The following examples include only the most commonly used actions. For a complete list, see the [AWS Identity and Access Management API Reference](https://docs.aws.amazon.com/IAM/latest/APIReference/welcome.html).
**Topics**
+ [`AddClientIdToOpenIdConnectProvider`](iam_example_iam_AddClientIdToOpenIdConnectProvider_section.md)
+ [`AddRoleToInstanceProfile`](iam_example_iam_AddRoleToInstanceProfile_section.md)
+ [`AddUserToGroup`](iam_example_iam_AddUserToGroup_section.md)
+ [`AttachGroupPolicy`](iam_example_iam_AttachGroupPolicy_section.md)
+ [`AttachRolePolicy`](iam_example_iam_AttachRolePolicy_section.md)
+ [`AttachUserPolicy`](iam_example_iam_AttachUserPolicy_section.md)
+ [`ChangePassword`](iam_example_iam_ChangePassword_section.md)
+ [`CreateAccessKey`](iam_example_iam_CreateAccessKey_section.md)
+ [`CreateAccountAlias`](iam_example_iam_CreateAccountAlias_section.md)
+ [`CreateGroup`](iam_example_iam_CreateGroup_section.md)
+ [`CreateInstanceProfile`](iam_example_iam_CreateInstanceProfile_section.md)
+ [`CreateLoginProfile`](iam_example_iam_CreateLoginProfile_section.md)
+ [`CreateOpenIdConnectProvider`](iam_example_iam_CreateOpenIdConnectProvider_section.md)
+ [`CreatePolicy`](iam_example_iam_CreatePolicy_section.md)
+ [`CreatePolicyVersion`](iam_example_iam_CreatePolicyVersion_section.md)
+ [`CreateRole`](iam_example_iam_CreateRole_section.md)
+ [`CreateSAMLProvider`](iam_example_iam_CreateSAMLProvider_section.md)
+ [`CreateServiceLinkedRole`](iam_example_iam_CreateServiceLinkedRole_section.md)
+ [`CreateUser`](iam_example_iam_CreateUser_section.md)
+ [`CreateVirtualMfaDevice`](iam_example_iam_CreateVirtualMfaDevice_section.md)
+ [`DeactivateMfaDevice`](iam_example_iam_DeactivateMfaDevice_section.md)
+ [`DeleteAccessKey`](iam_example_iam_DeleteAccessKey_section.md)
+ [`DeleteAccountAlias`](iam_example_iam_DeleteAccountAlias_section.md)
+ [`DeleteAccountPasswordPolicy`](iam_example_iam_DeleteAccountPasswordPolicy_section.md)
+ [`DeleteGroup`](iam_example_iam_DeleteGroup_section.md)
+ [`DeleteGroupPolicy`](iam_example_iam_DeleteGroupPolicy_section.md)
+ [`DeleteInstanceProfile`](iam_example_iam_DeleteInstanceProfile_section.md)
+ [`DeleteLoginProfile`](iam_example_iam_DeleteLoginProfile_section.md)
+ [`DeleteOpenIdConnectProvider`](iam_example_iam_DeleteOpenIdConnectProvider_section.md)
+ [`DeletePolicy`](iam_example_iam_DeletePolicy_section.md)
+ [`DeletePolicyVersion`](iam_example_iam_DeletePolicyVersion_section.md)
+ [`DeleteRole`](iam_example_iam_DeleteRole_section.md)
+ [`DeleteRolePermissionsBoundary`](iam_example_iam_DeleteRolePermissionsBoundary_section.md)
+ [`DeleteRolePolicy`](iam_example_iam_DeleteRolePolicy_section.md)
+ [`DeleteSAMLProvider`](iam_example_iam_DeleteSAMLProvider_section.md)
+ [`DeleteServerCertificate`](iam_example_iam_DeleteServerCertificate_section.md)
+ [`DeleteServiceLinkedRole`](iam_example_iam_DeleteServiceLinkedRole_section.md)
+ [`DeleteSigningCertificate`](iam_example_iam_DeleteSigningCertificate_section.md)
+ [`DeleteUser`](iam_example_iam_DeleteUser_section.md)
+ [`DeleteUserPermissionsBoundary`](iam_example_iam_DeleteUserPermissionsBoundary_section.md)
+ [`DeleteUserPolicy`](iam_example_iam_DeleteUserPolicy_section.md)
+ [`DeleteVirtualMfaDevice`](iam_example_iam_DeleteVirtualMfaDevice_section.md)
+ [`DetachGroupPolicy`](iam_example_iam_DetachGroupPolicy_section.md)
+ [`DetachRolePolicy`](iam_example_iam_DetachRolePolicy_section.md)
+ [`DetachUserPolicy`](iam_example_iam_DetachUserPolicy_section.md)
+ [`EnableMfaDevice`](iam_example_iam_EnableMfaDevice_section.md)
+ [`GenerateCredentialReport`](iam_example_iam_GenerateCredentialReport_section.md)
+ [`GenerateServiceLastAccessedDetails`](iam_example_iam_GenerateServiceLastAccessedDetails_section.md)
+ [`GetAccessKeyLastUsed`](iam_example_iam_GetAccessKeyLastUsed_section.md)
+ [`GetAccountAuthorizationDetails`](iam_example_iam_GetAccountAuthorizationDetails_section.md)
+ [`GetAccountPasswordPolicy`](iam_example_iam_GetAccountPasswordPolicy_section.md)
+ [`GetAccountSummary`](iam_example_iam_GetAccountSummary_section.md)
+ [`GetContextKeysForCustomPolicy`](iam_example_iam_GetContextKeysForCustomPolicy_section.md)
+ [`GetContextKeysForPrincipalPolicy`](iam_example_iam_GetContextKeysForPrincipalPolicy_section.md)
+ [`GetCredentialReport`](iam_example_iam_GetCredentialReport_section.md)
+ [`GetGroup`](iam_example_iam_GetGroup_section.md)
+ [`GetGroupPolicy`](iam_example_iam_GetGroupPolicy_section.md)
+ [`GetInstanceProfile`](iam_example_iam_GetInstanceProfile_section.md)
+ [`GetLoginProfile`](iam_example_iam_GetLoginProfile_section.md)
+ [`GetOpenIdConnectProvider`](iam_example_iam_GetOpenIdConnectProvider_section.md)
+ [`GetPolicy`](iam_example_iam_GetPolicy_section.md)
+ [`GetPolicyVersion`](iam_example_iam_GetPolicyVersion_section.md)
+ [`GetRole`](iam_example_iam_GetRole_section.md)
+ [`GetRolePolicy`](iam_example_iam_GetRolePolicy_section.md)
+ [`GetSamlProvider`](iam_example_iam_GetSamlProvider_section.md)
+ [`GetServerCertificate`](iam_example_iam_GetServerCertificate_section.md)
+ [`GetServiceLastAccessedDetails`](iam_example_iam_GetServiceLastAccessedDetails_section.md)
+ [`GetServiceLastAccessedDetailsWithEntities`](iam_example_iam_GetServiceLastAccessedDetailsWithEntities_section.md)
+ [`GetServiceLinkedRoleDeletionStatus`](iam_example_iam_GetServiceLinkedRoleDeletionStatus_section.md)
+ [`GetUser`](iam_example_iam_GetUser_section.md)
+ [`GetUserPolicy`](iam_example_iam_GetUserPolicy_section.md)
+ [`ListAccessKeys`](iam_example_iam_ListAccessKeys_section.md)
+ [`ListAccountAliases`](iam_example_iam_ListAccountAliases_section.md)
+ [`ListAttachedGroupPolicies`](iam_example_iam_ListAttachedGroupPolicies_section.md)
+ [`ListAttachedRolePolicies`](iam_example_iam_ListAttachedRolePolicies_section.md)
+ [`ListAttachedUserPolicies`](iam_example_iam_ListAttachedUserPolicies_section.md)
+ [`ListEntitiesForPolicy`](iam_example_iam_ListEntitiesForPolicy_section.md)
+ [`ListGroupPolicies`](iam_example_iam_ListGroupPolicies_section.md)
+ [`ListGroups`](iam_example_iam_ListGroups_section.md)
+ [`ListGroupsForUser`](iam_example_iam_ListGroupsForUser_section.md)
+ [`ListInstanceProfiles`](iam_example_iam_ListInstanceProfiles_section.md)
+ [`ListInstanceProfilesForRole`](iam_example_iam_ListInstanceProfilesForRole_section.md)
+ [`ListMfaDevices`](iam_example_iam_ListMfaDevices_section.md)
+ [`ListOpenIdConnectProviders`](iam_example_iam_ListOpenIdConnectProviders_section.md)
+ [`ListPolicies`](iam_example_iam_ListPolicies_section.md)
+ [`ListPolicyVersions`](iam_example_iam_ListPolicyVersions_section.md)
+ [`ListRolePolicies`](iam_example_iam_ListRolePolicies_section.md)
+ [`ListRoleTags`](iam_example_iam_ListRoleTags_section.md)
+ [`ListRoles`](iam_example_iam_ListRoles_section.md)
+ [`ListSAMLProviders`](iam_example_iam_ListSAMLProviders_section.md)
+ [`ListServerCertificates`](iam_example_iam_ListServerCertificates_section.md)
+ [`ListSigningCertificates`](iam_example_iam_ListSigningCertificates_section.md)
+ [`ListUserPolicies`](iam_example_iam_ListUserPolicies_section.md)
+ [`ListUserTags`](iam_example_iam_ListUserTags_section.md)
+ [`ListUsers`](iam_example_iam_ListUsers_section.md)
+ [`ListVirtualMfaDevices`](iam_example_iam_ListVirtualMfaDevices_section.md)
+ [`PutGroupPolicy`](iam_example_iam_PutGroupPolicy_section.md)
+ [`PutRolePermissionsBoundary`](iam_example_iam_PutRolePermissionsBoundary_section.md)
+ [`PutRolePolicy`](iam_example_iam_PutRolePolicy_section.md)
+ [`PutUserPermissionsBoundary`](iam_example_iam_PutUserPermissionsBoundary_section.md)
+ [`PutUserPolicy`](iam_example_iam_PutUserPolicy_section.md)
+ [`RemoveClientIdFromOpenIdConnectProvider`](iam_example_iam_RemoveClientIdFromOpenIdConnectProvider_section.md)
+ [`RemoveRoleFromInstanceProfile`](iam_example_iam_RemoveRoleFromInstanceProfile_section.md)
+ [`RemoveUserFromGroup`](iam_example_iam_RemoveUserFromGroup_section.md)
+ [`ResyncMfaDevice`](iam_example_iam_ResyncMfaDevice_section.md)
+ [`SetDefaultPolicyVersion`](iam_example_iam_SetDefaultPolicyVersion_section.md)
+ [`TagRole`](iam_example_iam_TagRole_section.md)
+ [`TagUser`](iam_example_iam_TagUser_section.md)
+ [`UntagRole`](iam_example_iam_UntagRole_section.md)
+ [`UntagUser`](iam_example_iam_UntagUser_section.md)
+ [`UpdateAccessKey`](iam_example_iam_UpdateAccessKey_section.md)
+ [`UpdateAccountPasswordPolicy`](iam_example_iam_UpdateAccountPasswordPolicy_section.md)
+ [`UpdateAssumeRolePolicy`](iam_example_iam_UpdateAssumeRolePolicy_section.md)
+ [`UpdateGroup`](iam_example_iam_UpdateGroup_section.md)
+ [`UpdateLoginProfile`](iam_example_iam_UpdateLoginProfile_section.md)
+ [`UpdateOpenIdConnectProviderThumbprint`](iam_example_iam_UpdateOpenIdConnectProviderThumbprint_section.md)
+ [`UpdateRole`](iam_example_iam_UpdateRole_section.md)
+ [`UpdateRoleDescription`](iam_example_iam_UpdateRoleDescription_section.md)
+ [`UpdateSamlProvider`](iam_example_iam_UpdateSamlProvider_section.md)
+ [`UpdateServerCertificate`](iam_example_iam_UpdateServerCertificate_section.md)
+ [`UpdateSigningCertificate`](iam_example_iam_UpdateSigningCertificate_section.md)
+ [`UpdateUser`](iam_example_iam_UpdateUser_section.md)
+ [`UploadServerCertificate`](iam_example_iam_UploadServerCertificate_section.md)
+ [`UploadSigningCertificate`](iam_example_iam_UploadSigningCertificate_section.md)
# Use `AddClientIdToOpenIdConnectProvider` with a CLI
The following code examples show how to use `AddClientIdToOpenIdConnectProvider`.
------
#### [ CLI ]
**AWS CLI**
**To add a client ID (audience) to an Open-ID Connect (OIDC) provider**
The following `add-client-id-to-open-id-connect-provider` command adds the client ID `my-application-ID` to the OIDC provider named `server.example.com`.
```
aws iam add-client-id-to-open-id-connect-provider \
--client-id my-application-ID \
--open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/server.example.com
```
This command produces no output.
To create an OIDC provider, use the `create-open-id-connect-provider` command.
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [AddClientIdToOpenIdConnectProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/add-client-id-to-open-id-connect-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command adds the client ID (or audience) `my-application-ID` to the existing OIDC provider named `server.example.com`.**
```
Add-IAMClientIDToOpenIDConnectProvider -ClientID "my-application-ID" -OpenIDConnectProviderARN "arn:aws:iam::123456789012:oidc-provider/server.example.com"
```
+ For API details, see [AddClientIdToOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command adds the client ID (or audience) `my-application-ID` to the existing OIDC provider named `server.example.com`.**
```
Add-IAMClientIDToOpenIDConnectProvider -ClientID "my-application-ID" -OpenIDConnectProviderARN "arn:aws:iam::123456789012:oidc-provider/server.example.com"
```
+ For API details, see [AddClientIdToOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `AddRoleToInstanceProfile` with a CLI
The following code examples show how to use `AddRoleToInstanceProfile`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Creating an Amazon ECS service for the EC2 launch type](iam_example_ecs_GettingStarted_018_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ CLI ]
**AWS CLI**
**To add a role to an instance profile**
The following `add-role-to-instance-profile` command adds the role named `S3Access` to the instance profile named `Webserver`.
```
aws iam add-role-to-instance-profile \
--role-name S3Access \
--instance-profile-name Webserver
```
This command produces no output.
To create an instance profile, use the `create-instance-profile` command.
For more information, see [Using an IAM role to grant permissions to applications running on Amazon EC2 instances](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html) in the *AWS IAM User Guide*.
+ For API details, see [AddRoleToInstanceProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/add-role-to-instance-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command adds the role named `S3Access` to an existing instance profile named `webserver`. To create the instance profile, use the `New-IAMInstanceProfile` command. After you create the instance profile and associate it with a role using this command, you can attach it to an EC2 instance. To do that, use the `New-EC2Instance` cmdlet with either the `InstanceProfile_Arn` or the `InstanceProfile-Name` parameter to launch the new instance.**
```
Add-IAMRoleToInstanceProfile -RoleName "S3Access" -InstanceProfileName "webserver"
```
+ For API details, see [AddRoleToInstanceProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command adds the role named `S3Access` to an existing instance profile named `webserver`. To create the instance profile, use the `New-IAMInstanceProfile` command. After you create the instance profile and associate it with a role using this command, you can attach it to an EC2 instance. To do that, use the `New-EC2Instance` cmdlet with either the `InstanceProfile_Arn` or the `InstanceProfile-Name` parameter to launch the new instance.**
```
Add-IAMRoleToInstanceProfile -RoleName "S3Access" -InstanceProfileName "webserver"
```
+ For API details, see [AddRoleToInstanceProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `AddUserToGroup` with a CLI
The following code examples show how to use `AddUserToGroup`.
------
#### [ CLI ]
**AWS CLI**
**To add a user to an IAM group**
The following `add-user-to-group` command adds an IAM user named `Bob` to the IAM group named `Admins`.
```
aws iam add-user-to-group \
--user-name Bob \
--group-name Admins
```
This command produces no output.
For more information, see [Adding and removing users in an IAM user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_add-remove-users.html) in the *AWS IAM User Guide*.
+ For API details, see [AddUserToGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/add-user-to-group.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command adds the user named `Bob` to the group named `Admins`.**
```
Add-IAMUserToGroup -UserName "Bob" -GroupName "Admins"
```
+ For API details, see [AddUserToGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command adds the user named `Bob` to the group named `Admins`.**
```
Add-IAMUserToGroup -UserName "Bob" -GroupName "Admins"
```
+ For API details, see [AddUserToGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `AttachGroupPolicy` with a CLI
The following code examples show how to use `AttachGroupPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To attach a managed policy to an IAM group**
The following `attach-group-policy` command attaches the AWS managed policy named `ReadOnlyAccess` to the IAM group named `Finance`.
```
aws iam attach-group-policy \
--policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess \
--group-name Finance
```
This command produces no output.
For more information, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) in the *AWS IAM User Guide*.
+ For API details, see [AttachGroupPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-group-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example attaches the customer managed policy named `TesterPolicy` to the IAM group `Testers`. The users in that group are immediately affected by the permissions defined in the default version of that policy.**
```
Register-IAMGroupPolicy -GroupName Testers -PolicyArn arn:aws:iam::123456789012:policy/TesterPolicy
```
**Example 2: This example attaches the AWS managed policy named `AdministratorAccess` to the IAM group `Admins`. The users in that group are immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMGroupPolicy -GroupName Admins -PolicyArn arn:aws:iam::aws:policy/AdministratorAccess
```
+ For API details, see [AttachGroupPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example attaches the customer managed policy named `TesterPolicy` to the IAM group `Testers`. The users in that group are immediately affected by the permissions defined in the default version of that policy.**
```
Register-IAMGroupPolicy -GroupName Testers -PolicyArn arn:aws:iam::123456789012:policy/TesterPolicy
```
**Example 2: This example attaches the AWS managed policy named `AdministratorAccess` to the IAM group `Admins`. The users in that group are immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMGroupPolicy -GroupName Admins -PolicyArn arn:aws:iam::aws:policy/AdministratorAccess
```
+ For API details, see [AttachGroupPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `AttachRolePolicy` with an AWS SDK or CLI
The following code examples show how to use `AttachRolePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Configure Amazon ECS Service Connect](iam_example_ecs_ServiceConnect_085_section.md)
+ [Create a REST API with Lambda proxy integration](iam_example_api_gateway_GettingStarted_087_section.md)
+ [Create an Amazon ECS Linux task for the Fargate launch type](iam_example_ecs_GettingStarted_086_section.md)
+ [Creating a CloudWatch dashboard with function name as a variable](iam_example_cloudwatch_GettingStarted_031_section.md)
+ [Creating an Amazon ECS service for the EC2 launch type](iam_example_ecs_GettingStarted_018_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Creating your first Lambda function](iam_example_lambda_GettingStarted_019_section.md)
+ [Getting started with Amazon EKS](iam_example_eks_GettingStarted_034_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Amazon SageMaker Feature Store](iam_example_iam_GettingStarted_028_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage roles](iam_example_iam_Scenario_RoleManagement_section.md)
+ [Moving hardcoded secrets to Secrets Manager](iam_example_secrets_manager_GettingStarted_073_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
+ [Using property variables in CloudWatch dashboards to monitor multiple Lambda functions](iam_example_iam_GettingStarted_032_section.md)
+ [Work with Streams and Time-to-Live](iam_example_dynamodb_Scenario_StreamsAndTTL_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Attach an IAM policy to a role.
///
/// The policy to attach.
/// The role that the policy will be attached to.
/// A Boolean value indicating the success of the action.
public async Task AttachRolePolicyAsync(string policyArn, string roleName)
{
var response = await _IAMService.AttachRolePolicyAsync(new AttachRolePolicyRequest
{
PolicyArn = policyArn,
RoleName = roleName,
});
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_attach_role_policy
#
# This function attaches an IAM policy to a tole.
#
# Parameters:
# -n role_name -- The name of the IAM role.
# -p policy_ARN -- The IAM policy document ARN..
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_attach_role_policy() {
local role_name policy_arn response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_attach_role_policy"
echo "Attaches an AWS Identity and Access Management (IAM) policy to an IAM role."
echo " -n role_name The name of the IAM role."
echo " -p policy_ARN -- The IAM policy document ARN."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:p:h" option; do
case "${option}" in
n) role_name="${OPTARG}" ;;
p) policy_arn="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$role_name" ]]; then
errecho "ERROR: You must provide a role name with the -n parameter."
usage
return 1
fi
if [[ -z "$policy_arn" ]]; then
errecho "ERROR: You must provide a policy ARN with the -p parameter."
usage
return 1
fi
response=$(aws iam attach-role-policy \
--role-name "$role_name" \
--policy-arn "$policy_arn")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports attach-role-policy operation failed.\n$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/AttachRolePolicy) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::attachRolePolicy(const Aws::String &roleName,
const Aws::String &policyArn,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListAttachedRolePoliciesRequest list_request;
list_request.SetRoleName(roleName);
bool done = false;
while (!done) {
auto list_outcome = iam.ListAttachedRolePolicies(list_request);
if (!list_outcome.IsSuccess()) {
std::cerr << "Failed to list attached policies of role " <<
roleName << ": " << list_outcome.GetError().GetMessage() <<
std::endl;
return false;
}
const auto &policies = list_outcome.GetResult().GetAttachedPolicies();
if (std::any_of(policies.cbegin(), policies.cend(),
[=](const Aws::IAM::Model::AttachedPolicy &policy) {
return policy.GetPolicyArn() == policyArn;
})) {
std::cout << "Policy " << policyArn <<
" is already attached to role " << roleName << std::endl;
return true;
}
done = !list_outcome.GetResult().GetIsTruncated();
list_request.SetMarker(list_outcome.GetResult().GetMarker());
}
Aws::IAM::Model::AttachRolePolicyRequest request;
request.SetRoleName(roleName);
request.SetPolicyArn(policyArn);
Aws::IAM::Model::AttachRolePolicyOutcome outcome = iam.AttachRolePolicy(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to attach policy " << policyArn << " to role " <<
roleName << ": " << outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully attached policy " << policyArn << " to role " <<
roleName << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To attach a managed policy to an IAM role**
The following `attach-role-policy` command attaches the AWS managed policy named `ReadOnlyAccess` to the IAM role named `ReadOnlyRole`.
```
aws iam attach-role-policy \
--policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess \
--role-name ReadOnlyRole
```
This command produces no output.
For more information, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) in the *AWS IAM User Guide*.
+ For API details, see [AttachRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// AttachRolePolicy attaches a policy to a role.
func (wrapper RoleWrapper) AttachRolePolicy(ctx context.Context, policyArn string, roleName string) error {
_, err := wrapper.IamClient.AttachRolePolicy(ctx, &iam.AttachRolePolicyInput{
PolicyArn: aws.String(policyArn),
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't attach policy %v to role %v. Here's why: %v\n", policyArn, roleName, err)
}
return err
}
```
+ For API details, see [AttachRolePolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.AttachRolePolicy) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.AttachRolePolicyRequest;
import software.amazon.awssdk.services.iam.model.AttachedPolicy;
import software.amazon.awssdk.services.iam.model.ListAttachedRolePoliciesRequest;
import software.amazon.awssdk.services.iam.model.ListAttachedRolePoliciesResponse;
import java.util.List;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class AttachRolePolicy {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
roleName - A role name that you can obtain from the AWS Management Console.\s
policyArn - A policy ARN that you can obtain from the AWS Management Console.\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String roleName = args[0];
String policyArn = args[1];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
attachIAMRolePolicy(iam, roleName, policyArn);
iam.close();
}
public static void attachIAMRolePolicy(IamClient iam, String roleName, String policyArn) {
try {
ListAttachedRolePoliciesRequest request = ListAttachedRolePoliciesRequest.builder()
.roleName(roleName)
.build();
ListAttachedRolePoliciesResponse response = iam.listAttachedRolePolicies(request);
List attachedPolicies = response.attachedPolicies();
// Ensure that the policy is not attached to this role
String polArn = "";
for (AttachedPolicy policy : attachedPolicies) {
polArn = policy.policyArn();
if (polArn.compareTo(policyArn) == 0) {
System.out.println(roleName + " policy is already attached to this role.");
return;
}
}
AttachRolePolicyRequest attachRequest = AttachRolePolicyRequest.builder()
.roleName(roleName)
.policyArn(policyArn)
.build();
iam.attachRolePolicy(attachRequest);
System.out.println("Successfully attached policy " + policyArn +
" to role " + roleName);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
System.out.println("Done");
}
}
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Attach the policy.
```
import { AttachRolePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} policyArn
* @param {string} roleName
*/
export const attachRolePolicy = (policyArn, roleName) => {
const command = new AttachRolePolicyCommand({
PolicyArn: policyArn,
RoleName: roleName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-policies.html#iam-examples-policies-attaching-role-policy).
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/AttachRolePolicyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var paramsRoleList = {
RoleName: process.argv[2],
};
iam.listAttachedRolePolicies(paramsRoleList, function (err, data) {
if (err) {
console.log("Error", err);
} else {
var myRolePolicies = data.AttachedPolicies;
myRolePolicies.forEach(function (val, index, array) {
if (myRolePolicies[index].PolicyName === "AmazonDynamoDBFullAccess") {
console.log(
"AmazonDynamoDBFullAccess is already attached to this role."
);
process.exit();
}
});
var params = {
PolicyArn: "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
RoleName: process.argv[2],
};
iam.attachRolePolicy(params, function (err, data) {
if (err) {
console.log("Unable to attach policy to role", err);
} else {
console.log("Role attached successfully");
}
});
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-policies.html#iam-examples-policies-attaching-role-policy).
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun attachIAMRolePolicy(
roleNameVal: String,
policyArnVal: String,
) {
val request =
ListAttachedRolePoliciesRequest {
roleName = roleNameVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.listAttachedRolePolicies(request)
val attachedPolicies = response.attachedPolicies
// Ensure that the policy is not attached to this role.
val checkStatus: Int
if (attachedPolicies != null) {
checkStatus = checkList(attachedPolicies, policyArnVal)
if (checkStatus == -1) {
return
}
}
val policyRequest =
AttachRolePolicyRequest {
roleName = roleNameVal
policyArn = policyArnVal
}
iamClient.attachRolePolicy(policyRequest)
println("Successfully attached policy $policyArnVal to role $roleNameVal")
}
}
fun checkList(
attachedPolicies: List,
policyArnVal: String,
): Int {
for (policy in attachedPolicies) {
val polArn = policy.policyArn.toString()
if (polArn.compareTo(policyArnVal) == 0) {
println("The policy is already attached to this role.")
return -1
}
}
return 0
}
```
+ For API details, see [AttachRolePolicy](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
$assumeRolePolicyDocument = "{
\"Version\": \"2012-10-17\",
\"Statement\": [{
\"Effect\": \"Allow\",
\"Principal\": {\"AWS\": \"{$user['Arn']}\"},
\"Action\": \"sts:AssumeRole\"
}]
}";
$assumeRoleRole = $service->createRole("iam_demo_role_$uuid", $assumeRolePolicyDocument);
echo "Created role: {$assumeRoleRole['RoleName']}\n";
$listAllBucketsPolicyDocument = "{
\"Version\": \"2012-10-17\",
\"Statement\": [{
\"Effect\": \"Allow\",
\"Action\": \"s3:ListAllMyBuckets\",
\"Resource\": \"arn:aws:s3:::*\"}]
}";
$listAllBucketsPolicy = $service->createPolicy("iam_demo_policy_$uuid", $listAllBucketsPolicyDocument);
echo "Created policy: {$listAllBucketsPolicy['PolicyName']}\n";
$service->attachRolePolicy($assumeRoleRole['RoleName'], $listAllBucketsPolicy['Arn']);
public function attachRolePolicy($roleName, $policyArn)
{
return $this->customWaiter(function () use ($roleName, $policyArn) {
$this->iamClient->attachRolePolicy([
'PolicyArn' => $policyArn,
'RoleName' => $roleName,
]);
});
}
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example attaches the AWS managed policy named `SecurityAudit` to the IAM role `CoSecurityAuditors`. The users who assume that role are immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMRolePolicy -RoleName CoSecurityAuditors -PolicyArn arn:aws:iam::aws:policy/SecurityAudit
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example attaches the AWS managed policy named `SecurityAudit` to the IAM role `CoSecurityAuditors`. The users who assume that role are immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMRolePolicy -RoleName CoSecurityAuditors -PolicyArn arn:aws:iam::aws:policy/SecurityAudit
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
Attach a policy to a role using the Boto3 Policy object.
```
def attach_to_role(role_name, policy_arn):
"""
Attaches a policy to a role.
:param role_name: The name of the role. **Note** this is the name, not the ARN.
:param policy_arn: The ARN of the policy.
"""
try:
iam.Policy(policy_arn).attach_role(RoleName=role_name)
logger.info("Attached policy %s to role %s.", policy_arn, role_name)
except ClientError:
logger.exception("Couldn't attach policy %s to role %s.", policy_arn, role_name)
raise
```
Attach a policy to a role using the Boto3 Role object.
```
def attach_policy(role_name, policy_arn):
"""
Attaches a policy to a role.
:param role_name: The name of the role. **Note** this is the name, not the ARN.
:param policy_arn: The ARN of the policy.
"""
try:
iam.Role(role_name).attach_policy(PolicyArn=policy_arn)
logger.info("Attached policy %s to role %s.", policy_arn, role_name)
except ClientError:
logger.exception("Couldn't attach policy %s to role %s.", policy_arn, role_name)
raise
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, attaches, and detaches role policies.
```
# Manages policies in AWS Identity and Access Management (IAM)
class RolePolicyManager
# Initialize with an AWS IAM client
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'PolicyManager'
end
# Creates a policy
#
# @param policy_name [String] The name of the policy
# @param policy_document [Hash] The policy document
# @return [String] The policy ARN if successful, otherwise nil
def create_policy(policy_name, policy_document)
response = @iam_client.create_policy(
policy_name: policy_name,
policy_document: policy_document.to_json
)
response.policy.arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating policy: #{e.message}")
nil
end
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
# Attaches a policy to a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_role(role_name, policy_arn)
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to role: #{e.message}")
false
end
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
# Detaches a policy from a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def detach_policy_from_role(role_name, policy_arn)
@iam_client.detach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from role: #{e.message}")
false
end
end
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/AttachRolePolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn attach_role_policy(
client: &iamClient,
role: &Role,
policy: &Policy,
) -> Result> {
client
.attach_role_policy()
.role_name(role.role_name())
.policy_arn(policy.arn().unwrap_or_default())
.send()
.await
}
```
+ For API details, see [AttachRolePolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.attach_role_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->attachrolepolicy(
iv_rolename = iv_role_name
iv_policyarn = iv_policy_arn ).
MESSAGE 'Policy attached to role successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role or policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Policy attachment limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [AttachRolePolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func attachRolePolicy(role: String, policyArn: String) async throws {
let input = AttachRolePolicyInput(
policyArn: policyArn,
roleName: role
)
do {
_ = try await client.attachRolePolicy(input: input)
} catch {
print("ERROR: Attaching a role policy:", dump(error))
throw error
}
}
```
+ For API details, see [AttachRolePolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/attachrolepolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `AttachUserPolicy` with an AWS SDK or CLI
The following code examples show how to use `AttachUserPolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ CLI ]
**AWS CLI**
**To attach a managed policy to an IAM user**
The following `attach-user-policy` command attaches the AWS managed policy named `AdministratorAccess` to the IAM user named `Alice`.
```
aws iam attach-user-policy \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
--user-name Alice
```
This command produces no output.
For more information, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) in the *AWS IAM User Guide*.
+ For API details, see [AttachUserPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-user-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example attaches the AWS managed policy named `AmazonCognitoPowerUser` to the IAM user `Bob`. The user is immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMUserPolicy -UserName Bob -PolicyArn arn:aws:iam::aws:policy/AmazonCognitoPowerUser
```
+ For API details, see [AttachUserPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example attaches the AWS managed policy named `AmazonCognitoPowerUser` to the IAM user `Bob`. The user is immediately affected by the permissions defined in the latest version of that policy.**
```
Register-IAMUserPolicy -UserName Bob -PolicyArn arn:aws:iam::aws:policy/AmazonCognitoPowerUser
```
+ For API details, see [AttachUserPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def attach_policy(user_name, policy_arn):
"""
Attaches a policy to a user.
:param user_name: The name of the user.
:param policy_arn: The Amazon Resource Name (ARN) of the policy.
"""
try:
iam.User(user_name).attach_policy(PolicyArn=policy_arn)
logger.info("Attached policy %s to user %s.", policy_arn, user_name)
except ClientError:
logger.exception("Couldn't attach policy %s to user %s.", policy_arn, user_name)
raise
```
+ For API details, see [AttachUserPolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/AttachUserPolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Attaches a policy to a user
#
# @param user_name [String] The name of the user
# @param policy_arn [String] The Amazon Resource Name (ARN) of the policy
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_user(user_name, policy_arn)
@iam_client.attach_user_policy(
user_name: user_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to user: #{e.message}")
false
end
```
+ For API details, see [AttachUserPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/AttachUserPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn attach_user_policy(
client: &iamClient,
user_name: &str,
policy_arn: &str,
) -> Result<(), iamError> {
client
.attach_user_policy()
.user_name(user_name)
.policy_arn(policy_arn)
.send()
.await?;
Ok(())
}
```
+ For API details, see [AttachUserPolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.attach_user_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->attachuserpolicy(
iv_username = iv_user_name
iv_policyarn = iv_policy_arn ).
MESSAGE 'Policy attached to user successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User or policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Policy attachment limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [AttachUserPolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `ChangePassword` with a CLI
The following code examples show how to use `ChangePassword`.
------
#### [ CLI ]
**AWS CLI**
**To change the password for your IAM user**
To change the password for your IAM user, we recommend using the `--cli-input-json` parameter to pass a JSON file that contains your old and new passwords. Using this method, you can use strong passwords with non-alphanumeric characters. It can be difficult to use passwords with non-alphanumeric characters when you pass them as command line parameters. To use the `--cli-input-json` parameter, start by using the `change-password` command with the `--generate-cli-skeleton` parameter, as in the following example.
```
aws iam change-password \
--generate-cli-skeleton > change-password.json
```
The previous command creates a JSON file called change-password.json that you can use to fill in your old and new passwords. For example, the file might look like the following.
```
{
"OldPassword": "3s0K_;xh4~8XXI",
"NewPassword": "]35d/{pB9Fo9wJ"
}
```
Next, to change your password, use the `change-password` command again, this time passing the `--cli-input-json` parameter to specify your JSON file. The following `change-password` command uses the `--cli-input-json` parameter with a JSON file called change-password.json.
```
aws iam change-password \
--cli-input-json file://change-password.json
```
This command produces no output.
This command can be called by IAM users only. If this command is called using AWS account (root) credentials, the command returns an `InvalidUserType` error.
For more information, see [How an IAM user changes their own password](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_user-change-own.html) in the *AWS IAM User Guide*.
+ For API details, see [ChangePassword](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/change-password.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command changes the password for the user that is running the command. This command can be called by IAM users only. If this command is called when you are signed-in with AWS account (root) credentials, the command returns an `InvalidUserType` error.**
```
Edit-IAMPassword -OldPassword "MyOldP@ssw0rd" -NewPassword "MyNewP@ssw0rd"
```
+ For API details, see [ChangePassword](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command changes the password for the user that is running the command. This command can be called by IAM users only. If this command is called when you are signed-in with AWS account (root) credentials, the command returns an `InvalidUserType` error.**
```
Edit-IAMPassword -OldPassword "MyOldP@ssw0rd" -NewPassword "MyNewP@ssw0rd"
```
+ For API details, see [ChangePassword](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `CreateAccessKey` with an AWS SDK or CLI
The following code examples show how to use `CreateAccessKey`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create an IAM access key for a user.
///
/// The username for which to create the IAM access
/// key.
/// The AccessKey.
public async Task CreateAccessKeyAsync(string userName)
{
var response = await _IAMService.CreateAccessKeyAsync(new CreateAccessKeyRequest
{
UserName = userName,
});
return response.AccessKey;
}
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreateAccessKey) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_create_user_access_key
#
# This function creates an IAM access key for the specified user.
#
# Parameters:
# -u user_name -- The name of the IAM user.
# [-f file_name] -- The optional file name for the access key output.
#
# Returns:
# [access_key_id access_key_secret]
# And:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_create_user_access_key() {
local user_name file_name response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_create_user_access_key"
echo "Creates an AWS Identity and Access Management (IAM) key pair."
echo " -u user_name The name of the IAM user."
echo " [-f file_name] Optional file name for the access key output."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:f:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
f) file_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
response=$(aws iam create-access-key \
--user-name "$user_name" \
--output text)
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-access-key operation failed.$response"
return 1
fi
if [[ -n "$file_name" ]]; then
echo "$response" >"$file_name"
fi
local key_id key_secret
# shellcheck disable=SC2086
key_id=$(echo $response | cut -f 2 -d ' ')
# shellcheck disable=SC2086
key_secret=$(echo $response | cut -f 4 -d ' ')
echo "$key_id $key_secret"
return 0
}
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/CreateAccessKey) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::String AwsDoc::IAM::createAccessKey(const Aws::String &userName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::CreateAccessKeyRequest request;
request.SetUserName(userName);
Aws::String result;
Aws::IAM::Model::CreateAccessKeyOutcome outcome = iam.CreateAccessKey(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error creating access key for IAM user " << userName
<< ":" << outcome.GetError().GetMessage() << std::endl;
}
else {
const auto &accessKey = outcome.GetResult().GetAccessKey();
std::cout << "Successfully created access key for IAM user " <<
userName << std::endl << " aws_access_key_id = " <<
accessKey.GetAccessKeyId() << std::endl <<
" aws_secret_access_key = " << accessKey.GetSecretAccessKey() <<
std::endl;
result = accessKey.GetAccessKeyId();
}
return result;
}
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/CreateAccessKey) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To create an access key for an IAM user**
The following `create-access-key` command creates an access key (access key ID and secret access key) for the IAM user named `Bob`.
```
aws iam create-access-key \
--user-name Bob
```
Output:
```
{
"AccessKey": {
"UserName": "Bob",
"Status": "Active",
"CreateDate": "2015-03-09T18:39:23.411Z",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
}
}
```
Store the secret access key in a secure location. If it is lost, it cannot be recovered, and you must create a new access key.
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateAccessKey](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// CreateAccessKeyPair creates an access key for a user. The returned access key contains
// the ID and secret credentials needed to use the key.
func (wrapper UserWrapper) CreateAccessKeyPair(ctx context.Context, userName string) (*types.AccessKey, error) {
var key *types.AccessKey
result, err := wrapper.IamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
UserName: aws.String(userName)})
if err != nil {
log.Printf("Couldn't create access key pair for user %v. Here's why: %v\n", userName, err)
} else {
key = result.AccessKey
}
return key, err
}
```
+ For API details, see [CreateAccessKey](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreateAccessKey) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.CreateAccessKeyRequest;
import software.amazon.awssdk.services.iam.model.CreateAccessKeyResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreateAccessKey {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
user - An AWS IAM user that you can obtain from the AWS Management Console.
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String user = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
String keyId = createIAMAccessKey(iam, user);
System.out.println("The Key Id is " + keyId);
iam.close();
}
public static String createIAMAccessKey(IamClient iam, String user) {
try {
CreateAccessKeyRequest request = CreateAccessKeyRequest.builder()
.userName(user)
.build();
CreateAccessKeyResponse response = iam.createAccessKey(request);
return response.accessKey().accessKeyId();
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
return "";
}
}
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/CreateAccessKey) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the access key.
```
import { CreateAccessKeyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} userName
*/
export const createAccessKey = (userName) => {
const command = new CreateAccessKeyCommand({ UserName: userName });
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-creating).
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateAccessKeyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.createAccessKey({ UserName: "IAM_USER_NAME" }, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data.AccessKey);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-creating).
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/CreateAccessKey) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun createIAMAccessKey(user: String?): String {
val request =
CreateAccessKeyRequest {
userName = user
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.createAccessKey(request)
return response.accessKey?.accessKeyId.toString()
}
}
```
+ For API details, see [CreateAccessKey](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new access key and secret access key pair and assigns it to the user `David`. Ensure that you save the `AccessKeyId` and `SecretAccessKey` values to a file because this is the only time you can obtain the `SecretAccessKey`. You cannot retrieve it later. If you lose the secret key, you must create a new access key pair.**
```
New-IAMAccessKey -UserName David
```
**Output:**
```
AccessKeyId : AKIAIOSFODNN7EXAMPLE
CreateDate : 4/13/2015 1:00:42 PM
SecretAccessKey : wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Status : Active
UserName : David
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new access key and secret access key pair and assigns it to the user `David`. Ensure that you save the `AccessKeyId` and `SecretAccessKey` values to a file because this is the only time you can obtain the `SecretAccessKey`. You cannot retrieve it later. If you lose the secret key, you must create a new access key pair.**
```
New-IAMAccessKey -UserName David
```
**Output:**
```
AccessKeyId : AKIAIOSFODNN7EXAMPLE
CreateDate : 4/13/2015 1:00:42 PM
SecretAccessKey : wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Status : Active
UserName : David
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_key(user_name):
"""
Creates an access key for the specified user. Each user can have a
maximum of two keys.
:param user_name: The name of the user.
:return: The created access key.
"""
try:
key_pair = iam.User(user_name).create_access_key_pair()
logger.info(
"Created access key pair for %s. Key ID is %s.",
key_pair.user_name,
key_pair.id,
)
except ClientError:
logger.exception("Couldn't create access key pair for %s.", user_name)
raise
else:
return key_pair
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateAccessKey) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, deactivates, and deletes access keys.
```
# Manages access keys for IAM users
class AccessKeyManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'AccessKeyManager'
end
# Lists access keys for a user
#
# @param user_name [String] The name of the user.
def list_access_keys(user_name)
response = @iam_client.list_access_keys(user_name: user_name)
if response.access_key_metadata.empty?
@logger.info("No access keys found for user '#{user_name}'.")
else
response.access_key_metadata.map(&:access_key_id)
end
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Error listing access keys: cannot find user '#{user_name}'.")
[]
rescue StandardError => e
@logger.error("Error listing access keys: #{e.message}")
[]
end
# Creates an access key for a user
#
# @param user_name [String] The name of the user.
# @return [Boolean]
def create_access_key(user_name)
response = @iam_client.create_access_key(user_name: user_name)
access_key = response.access_key
@logger.info("Access key created for user '#{user_name}': #{access_key.access_key_id}")
access_key
rescue Aws::IAM::Errors::LimitExceeded
@logger.error('Error creating access key: limit exceeded. Cannot create more.')
nil
rescue StandardError => e
@logger.error("Error creating access key: #{e.message}")
nil
end
# Deactivates an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def deactivate_access_key(user_name, access_key_id)
@iam_client.update_access_key(
user_name: user_name,
access_key_id: access_key_id,
status: 'Inactive'
)
true
rescue StandardError => e
@logger.error("Error deactivating access key: #{e.message}")
false
end
# Deletes an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def delete_access_key(user_name, access_key_id)
@iam_client.delete_access_key(
user_name: user_name,
access_key_id: access_key_id
)
true
rescue StandardError => e
@logger.error("Error deleting access key: #{e.message}")
false
end
end
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreateAccessKey) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_access_key(client: &iamClient, user_name: &str) -> Result {
let mut tries: i32 = 0;
let max_tries: i32 = 10;
let response: Result> = loop {
match client.create_access_key().user_name(user_name).send().await {
Ok(inner_response) => {
break Ok(inner_response);
}
Err(e) => {
tries += 1;
if tries > max_tries {
break Err(e);
}
sleep(Duration::from_secs(2)).await;
}
}
};
Ok(response.unwrap().access_key.unwrap())
}
```
+ For API details, see [CreateAccessKey](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_access_key) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createaccesskey(
iv_username = iv_user_name ).
MESSAGE 'Access key created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Maximum number of access keys reached.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createAccessKey(userName: String) async throws -> IAMClientTypes.AccessKey {
let input = CreateAccessKeyInput(
userName: userName
)
do {
let output = try await iamClient.createAccessKey(input: input)
guard let accessKey = output.accessKey else {
throw ServiceHandlerError.keyError
}
return accessKey
} catch {
print("ERROR: createAccessKey:", dump(error))
throw error
}
}
```
+ For API details, see [CreateAccessKey](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createaccesskey(input:)) in *AWS SDK for Swift API reference*.
------
# Use `CreateAccountAlias` with an AWS SDK or CLI
The following code examples show how to use `CreateAccountAlias`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::createAccountAlias(const Aws::String &aliasName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::CreateAccountAliasRequest request;
request.SetAccountAlias(aliasName);
Aws::IAM::Model::CreateAccountAliasOutcome outcome = iam.CreateAccountAlias(
request);
if (!outcome.IsSuccess()) {
std::cerr << "Error creating account alias " << aliasName << ": "
<< outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully created account alias " << aliasName <<
std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/CreateAccountAlias) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To create an account alias**
The following `create-account-alias` command creates the alias `examplecorp` for your AWS account.
```
aws iam create-account-alias \
--account-alias examplecorp
```
This command produces no output.
For more information, see [Your AWS account ID and its alias](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateAccountAlias](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-account-alias.html) in *AWS CLI Command Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.CreateAccountAliasRequest;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreateAccountAlias {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
alias - The account alias to create (for example, myawsaccount).\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String alias = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
createIAMAccountAlias(iam, alias);
iam.close();
System.out.println("Done");
}
public static void createIAMAccountAlias(IamClient iam, String alias) {
try {
CreateAccountAliasRequest request = CreateAccountAliasRequest.builder()
.accountAlias(alias)
.build();
iam.createAccountAlias(request);
System.out.println("Successfully created account alias: " + alias);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/CreateAccountAlias) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the account alias.
```
import { CreateAccountAliasCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} alias - A unique name for the account alias.
* @returns
*/
export const createAccountAlias = (alias) => {
const command = new CreateAccountAliasCommand({
AccountAlias: alias,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-creating).
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateAccountAliasCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.createAccountAlias({ AccountAlias: process.argv[2] }, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-creating).
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/CreateAccountAlias) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun createIAMAccountAlias(alias: String) {
val request =
CreateAccountAliasRequest {
accountAlias = alias
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.createAccountAlias(request)
println("Successfully created account alias named $alias")
}
}
```
+ For API details, see [CreateAccountAlias](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example changes the account alias for your AWS account to `mycompanyaws`. The address of the user logon page chages to https://mycompanyaws.signin.aws.amazon.com/console. The original URL using your account ID number instead of the alias (https://.signin.aws.amazon.com/console) continues to work. However, any previously defined alias-based URLs stop working.**
```
New-IAMAccountAlias -AccountAlias mycompanyaws
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example changes the account alias for your AWS account to `mycompanyaws`. The address of the user logon page chages to https://mycompanyaws.signin.aws.amazon.com/console. The original URL using your account ID number instead of the alias (https://.signin.aws.amazon.com/console) continues to work. However, any previously defined alias-based URLs stop working.**
```
New-IAMAccountAlias -AccountAlias mycompanyaws
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_alias(alias):
"""
Creates an alias for the current account. The alias can be used in place of the
account ID in the sign-in URL. An account can have only one alias. When a new
alias is created, it replaces any existing alias.
:param alias: The alias to assign to the account.
"""
try:
iam.create_account_alias(AccountAlias=alias)
logger.info("Created an alias '%s' for your account.", alias)
except ClientError:
logger.exception("Couldn't create alias '%s' for your account.", alias)
raise
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateAccountAlias) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, create, and delete account aliases.
```
class IAMAliasManager
# Initializes the IAM client and logger
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client.
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
end
# Lists available AWS account aliases.
def list_aliases
response = @iam_client.list_account_aliases
if response.account_aliases.count.positive?
@logger.info('Account aliases are:')
response.account_aliases.each { |account_alias| @logger.info(" #{account_alias}") }
else
@logger.info('No account aliases found.')
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing account aliases: #{e.message}")
end
# Creates an AWS account alias.
#
# @param account_alias [String] The name of the account alias to create.
# @return [Boolean] true if the account alias was created; otherwise, false.
def create_account_alias(account_alias)
@iam_client.create_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating account alias: #{e.message}")
false
end
# Deletes an AWS account alias.
#
# @param account_alias [String] The name of the account alias to delete.
# @return [Boolean] true if the account alias was deleted; otherwise, false.
def delete_account_alias(account_alias)
@iam_client.delete_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting account alias: #{e.message}")
false
end
end
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreateAccountAlias) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->createaccountalias(
iv_accountalias = iv_account_alias ).
MESSAGE 'Account alias created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamentityalrdyexex.
MESSAGE 'Account alias already exists.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Account alias limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateAccountAlias](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `CreateGroup` with an AWS SDK or CLI
The following code examples show how to use `CreateGroup`.
------
#### [ CLI ]
**AWS CLI**
**To create an IAM group**
The following `create-group` command creates an IAM group named `Admins`.
```
aws iam create-group \
--group-name Admins
```
Output:
```
{
"Group": {
"Path": "/",
"CreateDate": "2015-03-09T20:30:24.940Z",
"GroupId": "AIDGPMS9RO4H3FEXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/Admins",
"GroupName": "Admins"
}
}
```
For more information, see [Creating IAM user groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_create.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-group.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { CreateGroupCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} groupName
*/
export const createGroup = async (groupName) => {
const command = new CreateGroupCommand({ GroupName: groupName });
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [CreateGroup](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateGroupCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new IAM group named `Developers`.**
```
New-IAMGroup -GroupName Developers
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 4/14/2015 11:21:31 AM
GroupId : QNEJ5PM4NFSQCEXAMPLE1
GroupName : Developers
Path : /
```
+ For API details, see [CreateGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new IAM group named `Developers`.**
```
New-IAMGroup -GroupName Developers
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 4/14/2015 11:21:31 AM
GroupId : QNEJ5PM4NFSQCEXAMPLE1
GroupName : Developers
Path : /
```
+ For API details, see [CreateGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `CreateInstanceProfile` with an AWS SDK or CLI
The following code examples show how to use `CreateInstanceProfile`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Build and manage a resilient service](iam_example_cross_ResilientService_section.md)
+ [Creating an Amazon ECS service for the EC2 launch type](iam_example_ecs_GettingStarted_018_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/cross-service/ResilientService/AutoScalerActions#code-examples).
```
///
/// Create a policy, role, and profile that is associated with instances with a specified name.
/// An instance's associated profile defines a role that is assumed by the
/// instance.The role has attached policies that specify the AWS permissions granted to
/// clients that run on the instance.
///
/// Name to use for the policy.
/// Name to use for the role.
/// Name to use for the profile.
/// Path to a policy file for SSM.
/// AWS Managed policies to be attached to the role.
/// The Arn of the profile.
public async Task CreateInstanceProfileWithName(
string policyName,
string roleName,
string profileName,
string ssmOnlyPolicyFile,
List? awsManagedPolicies = null)
{
var assumeRoleDoc = "{" +
"\"Version\": \"2012-10-17\"," +
"\"Statement\": [{" +
"\"Effect\": \"Allow\"," +
"\"Principal\": {" +
"\"Service\": [" +
"\"ec2.amazonaws.com\"" +
"]" +
"}," +
"\"Action\": \"sts:AssumeRole\"" +
"}]" +
"}";
var policyDocument = await File.ReadAllTextAsync(ssmOnlyPolicyFile);
var policyArn = "";
try
{
var createPolicyResult = await _amazonIam.CreatePolicyAsync(
new CreatePolicyRequest
{
PolicyName = policyName,
PolicyDocument = policyDocument
});
policyArn = createPolicyResult.Policy.Arn;
}
catch (EntityAlreadyExistsException)
{
// The policy already exists, so we look it up to get the Arn.
var policiesPaginator = _amazonIam.Paginators.ListPolicies(
new ListPoliciesRequest()
{
Scope = PolicyScopeType.Local
});
// Get the entire list using the paginator.
await foreach (var policy in policiesPaginator.Policies)
{
if (policy.PolicyName.Equals(policyName))
{
policyArn = policy.Arn;
}
}
if (policyArn == null)
{
throw new InvalidOperationException("Policy not found");
}
}
try
{
await _amazonIam.CreateRoleAsync(new CreateRoleRequest()
{
RoleName = roleName,
AssumeRolePolicyDocument = assumeRoleDoc,
});
await _amazonIam.AttachRolePolicyAsync(new AttachRolePolicyRequest()
{
RoleName = roleName,
PolicyArn = policyArn
});
if (awsManagedPolicies != null)
{
foreach (var awsPolicy in awsManagedPolicies)
{
await _amazonIam.AttachRolePolicyAsync(new AttachRolePolicyRequest()
{
PolicyArn = $"arn:aws:iam::aws:policy/{awsPolicy}",
RoleName = roleName
});
}
}
}
catch (EntityAlreadyExistsException)
{
Console.WriteLine("Role already exists.");
}
string profileArn = "";
try
{
var profileCreateResponse = await _amazonIam.CreateInstanceProfileAsync(
new CreateInstanceProfileRequest()
{
InstanceProfileName = profileName
});
// Allow time for the profile to be ready.
profileArn = profileCreateResponse.InstanceProfile.Arn;
Thread.Sleep(10000);
await _amazonIam.AddRoleToInstanceProfileAsync(
new AddRoleToInstanceProfileRequest()
{
InstanceProfileName = profileName,
RoleName = roleName
});
}
catch (EntityAlreadyExistsException)
{
Console.WriteLine("Policy already exists.");
var profileGetResponse = await _amazonIam.GetInstanceProfileAsync(
new GetInstanceProfileRequest()
{
InstanceProfileName = profileName
});
profileArn = profileGetResponse.InstanceProfile.Arn;
}
return profileArn;
}
```
+ For API details, see [CreateInstanceProfile](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreateInstanceProfile) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To create an instance profile**
The following `create-instance-profile` command creates an instance profile named `Webserver`.
```
aws iam create-instance-profile \
--instance-profile-name Webserver
```
Output:
```
{
"InstanceProfile": {
"InstanceProfileId": "AIPAJMBYC7DLSPEXAMPLE",
"Roles": [],
"CreateDate": "2015-03-09T20:33:19.626Z",
"InstanceProfileName": "Webserver",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/Webserver"
}
}
```
To add a role to an instance profile, use the `add-role-to-instance-profile` command.
For more information, see [Using an IAM role to grant permissions to applications running on Amazon EC2 instances](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateInstanceProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-instance-profile.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/cross-services/wkflw-resilient-service#code-examples).
```
const { InstanceProfile } = await iamClient.send(
new CreateInstanceProfileCommand({
InstanceProfileName: NAMES.ssmOnlyInstanceProfileName,
}),
);
await waitUntilInstanceProfileExists(
{ client: iamClient },
{ InstanceProfileName: NAMES.ssmOnlyInstanceProfileName },
);
```
+ For API details, see [CreateInstanceProfile](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateInstanceProfileCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new IAM instance profile named `ProfileForDevEC2Instance`. You must separately run the `Add-IAMRoleToInstanceProfile` command to associate the instance profile with an existing IAM role that provides permissions to the instance. Finally, attach the instance profile to an EC2 instance when you launch it. To do that, use the `New-EC2Instance` cmdlet with either the `InstanceProfile_Arn` or `InstanceProfile_Name` parameter.**
```
New-IAMInstanceProfile -InstanceProfileName ProfileForDevEC2Instance
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ProfileForDevEC2Instance
CreateDate : 4/14/2015 11:31:39 AM
InstanceProfileId : DYMFXL556EY46EXAMPLE1
InstanceProfileName : ProfileForDevEC2Instance
Path : /
Roles : {}
```
+ For API details, see [CreateInstanceProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new IAM instance profile named `ProfileForDevEC2Instance`. You must separately run the `Add-IAMRoleToInstanceProfile` command to associate the instance profile with an existing IAM role that provides permissions to the instance. Finally, attach the instance profile to an EC2 instance when you launch it. To do that, use the `New-EC2Instance` cmdlet with either the `InstanceProfile_Arn` or `InstanceProfile_Name` parameter.**
```
New-IAMInstanceProfile -InstanceProfileName ProfileForDevEC2Instance
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ProfileForDevEC2Instance
CreateDate : 4/14/2015 11:31:39 AM
InstanceProfileId : DYMFXL556EY46EXAMPLE1
InstanceProfileName : ProfileForDevEC2Instance
Path : /
Roles : {}
```
+ For API details, see [CreateInstanceProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
This example creates a policy, role, and instance profile and links them all together.
```
class AutoScalingWrapper:
"""
Encapsulates Amazon EC2 Auto Scaling and EC2 management actions.
"""
def __init__(
self,
resource_prefix: str,
inst_type: str,
ami_param: str,
autoscaling_client: boto3.client,
ec2_client: boto3.client,
ssm_client: boto3.client,
iam_client: boto3.client,
):
"""
Initializes the AutoScaler class with the necessary parameters.
:param resource_prefix: The prefix for naming AWS resources that are created by this class.
:param inst_type: The type of EC2 instance to create, such as t3.micro.
:param ami_param: The Systems Manager parameter used to look up the AMI that is created.
:param autoscaling_client: A Boto3 EC2 Auto Scaling client.
:param ec2_client: A Boto3 EC2 client.
:param ssm_client: A Boto3 Systems Manager client.
:param iam_client: A Boto3 IAM client.
"""
self.inst_type = inst_type
self.ami_param = ami_param
self.autoscaling_client = autoscaling_client
self.ec2_client = ec2_client
self.ssm_client = ssm_client
self.iam_client = iam_client
sts_client = boto3.client("sts")
self.account_id = sts_client.get_caller_identity()["Account"]
self.key_pair_name = f"{resource_prefix}-key-pair"
self.launch_template_name = f"{resource_prefix}-template-"
self.group_name = f"{resource_prefix}-group"
# Happy path
self.instance_policy_name = f"{resource_prefix}-pol"
self.instance_role_name = f"{resource_prefix}-role"
self.instance_profile_name = f"{resource_prefix}-prof"
# Failure mode
self.bad_creds_policy_name = f"{resource_prefix}-bc-pol"
self.bad_creds_role_name = f"{resource_prefix}-bc-role"
self.bad_creds_profile_name = f"{resource_prefix}-bc-prof"
def create_instance_profile(
self,
policy_file: str,
policy_name: str,
role_name: str,
profile_name: str,
aws_managed_policies: Tuple[str, ...] = (),
) -> str:
"""
Creates a policy, role, and profile that is associated with instances created by
this class. An instance's associated profile defines a role that is assumed by the
instance. The role has attached policies that specify the AWS permissions granted to
clients that run on the instance.
:param policy_file: The name of a JSON file that contains the policy definition to
create and attach to the role.
:param policy_name: The name to give the created policy.
:param role_name: The name to give the created role.
:param profile_name: The name to the created profile.
:param aws_managed_policies: Additional AWS-managed policies that are attached to
the role, such as AmazonSSMManagedInstanceCore to grant
use of Systems Manager to send commands to the instance.
:return: The ARN of the profile that is created.
"""
assume_role_doc = {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"Service": "ec2.amazonaws.com"},
"Action": "sts:AssumeRole",
}
],
}
policy_arn = self.create_policy(policy_file, policy_name)
self.create_role(role_name, assume_role_doc)
self.attach_policy(role_name, policy_arn, aws_managed_policies)
try:
profile_response = self.iam_client.create_instance_profile(
InstanceProfileName=profile_name
)
waiter = self.iam_client.get_waiter("instance_profile_exists")
waiter.wait(InstanceProfileName=profile_name)
time.sleep(10) # wait a little longer
profile_arn = profile_response["InstanceProfile"]["Arn"]
self.iam_client.add_role_to_instance_profile(
InstanceProfileName=profile_name, RoleName=role_name
)
log.info("Created profile %s and added role %s.", profile_name, role_name)
except ClientError as err:
if err.response["Error"]["Code"] == "EntityAlreadyExists":
prof_response = self.iam_client.get_instance_profile(
InstanceProfileName=profile_name
)
profile_arn = prof_response["InstanceProfile"]["Arn"]
log.info(
"Instance profile %s already exists, nothing to do.", profile_name
)
log.error(f"Full error:\n\t{err}")
return profile_arn
```
+ For API details, see [CreateInstanceProfile](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateInstanceProfile) in *AWS SDK for Python (Boto3) API Reference*.
------
# Use `CreateLoginProfile` with a CLI
The following code examples show how to use `CreateLoginProfile`.
------
#### [ CLI ]
**AWS CLI**
**To create a password for an IAM user**
To create a password for an IAM user, we recommend using the `--cli-input-json` parameter to pass a JSON file that contains the password. Using this method, you can create a strong password with non-alphanumeric characters. It can be difficult to create a password with non-alphanumeric characters when you pass it as a command line parameter.
To use the `--cli-input-json` parameter, start by using the `create-login-profile` command with the `--generate-cli-skeleton` parameter, as in the following example.
```
aws iam create-login-profile \
--generate-cli-skeleton > create-login-profile.json
```
The previous command creates a JSON file called create-login-profile.json that you can use to fill in the information for a subsequent `create-login-profile` command. For example:
```
{
"UserName": "Bob",
"Password": "&1-3a6u:RA0djs",
"PasswordResetRequired": true
}
```
Next, to create a password for an IAM user, use the `create-login-profile` command again, this time passing the `--cli-input-json` parameter to specify your JSON file. The following `create-login-profile` command uses the `--cli-input-json` parameter with a JSON file called create-login-profile.json.
```
aws iam create-login-profile \
--cli-input-json file://create-login-profile.json
```
Output:
```
{
"LoginProfile": {
"UserName": "Bob",
"CreateDate": "2015-03-10T20:55:40.274Z",
"PasswordResetRequired": true
}
}
```
If the new password violates the account password policy, the command returns a `PasswordPolicyViolation` error.
To change the password for a user that already has one, use `update-login-profile`. To set a password policy for the account, use the `update-account-password-policy` command.
If the account password policy allows them to, IAM users can change their own passwords using the `change-password` command.
For more information, see [Managing passwords for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateLoginProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-login-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a (temporary) password for the IAM user named Bob, and sets the flag that requires the user to change the password the next time `Bob` signs in.**
```
New-IAMLoginProfile -UserName Bob -Password P@ssw0rd -PasswordResetRequired $true
```
**Output:**
```
CreateDate PasswordResetRequired UserName
---------- --------------------- --------
4/14/2015 12:26:30 PM True Bob
```
+ For API details, see [CreateLoginProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a (temporary) password for the IAM user named Bob, and sets the flag that requires the user to change the password the next time `Bob` signs in.**
```
New-IAMLoginProfile -UserName Bob -Password P@ssw0rd -PasswordResetRequired $true
```
**Output:**
```
CreateDate PasswordResetRequired UserName
---------- --------------------- --------
4/14/2015 12:26:30 PM True Bob
```
+ For API details, see [CreateLoginProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `CreateOpenIdConnectProvider` with a CLI
The following code examples show how to use `CreateOpenIdConnectProvider`.
------
#### [ CLI ]
**AWS CLI**
**To create an OpenID Connect (OIDC) provider**
To create an OpenID Connect (OIDC) provider, we recommend using the `--cli-input-json` parameter to pass a JSON file that contains the required parameters. When you create an OIDC provider, you must pass the URL of the provider, and the URL must begin with `https://`. It can be difficult to pass the URL as a command line parameter, because the colon (:) and forward slash (/) characters have special meaning in some command line environments. Using the `--cli-input-json` parameter gets around this limitation.
To use the `--cli-input-json` parameter, start by using the `create-open-id-connect-provider` command with the `--generate-cli-skeleton` parameter, as in the following example.
```
aws iam create-open-id-connect-provider \
--generate-cli-skeleton > create-open-id-connect-provider.json
```
The previous command creates a JSON file called create-open-id-connect-provider.json that you can use to fill in the information for a subsequent `create-open-id-connect-provider` command. For example:
```
{
"Url": "https://server.example.com",
"ClientIDList": [
"example-application-ID"
],
"ThumbprintList": [
"c3768084dfb3d2b68b7897bf5f565da8eEXAMPLE"
]
}
```
Next, to create the OpenID Connect (OIDC) provider, use the `create-open-id-connect-provider` command again, this time passing the `--cli-input-json` parameter to specify your JSON file. The following `create-open-id-connect-provider` command uses the `--cli-input-json` parameter with a JSON file called create-open-id-connect-provider.json.
```
aws iam create-open-id-connect-provider \
--cli-input-json file://create-open-id-connect-provider.json
```
Output:
```
{
"OpenIDConnectProviderArn": "arn:aws:iam::123456789012:oidc-provider/server.example.com"
}
```
For more information about OIDC providers, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
For more information about obtaining thumbprints for an OIDC provider, see [Obtaining the thumbprint for an OpenID Connect Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateOpenIdConnectProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-open-id-connect-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates an IAM OIDC provider associated with the OIDC compatible provider service found at the URL `https://example.oidcprovider.com` and the client ID `my-testapp-1`. The OIDC provider supplies the thumbprint. To authenticate the thumbprint, follow the steps at http://docs.aws.amazon.com/IAM/latest/UserGuide/identity-providers-oidc-obtain-thumbprint.html.**
```
New-IAMOpenIDConnectProvider -Url https://example.oidcprovider.com -ClientIDList my-testapp-1 -ThumbprintList 990F419EXAMPLEECF12DDEDA5EXAMPLE52F20D9E
```
**Output:**
```
arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [CreateOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates an IAM OIDC provider associated with the OIDC compatible provider service found at the URL `https://example.oidcprovider.com` and the client ID `my-testapp-1`. The OIDC provider supplies the thumbprint. To authenticate the thumbprint, follow the steps at http://docs.aws.amazon.com/IAM/latest/UserGuide/identity-providers-oidc-obtain-thumbprint.html.**
```
New-IAMOpenIDConnectProvider -Url https://example.oidcprovider.com -ClientIDList my-testapp-1 -ThumbprintList 990F419EXAMPLEECF12DDEDA5EXAMPLE52F20D9E
```
**Output:**
```
arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [CreateOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `CreatePolicy` with an AWS SDK or CLI
The following code examples show how to use `CreatePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Set up Attribute-Based Access Control](iam_example_dynamodb_Scenario_ABACSetup_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
+ [Work with the IAM Policy Builder API](iam_example_iam_Scenario_IamPolicyBuilder_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create an IAM policy.
///
/// The name to give the new IAM policy.
/// The policy document for the new policy.
/// The new IAM policy object.
public async Task CreatePolicyAsync(string policyName, string policyDocument)
{
var response = await _IAMService.CreatePolicyAsync(new CreatePolicyRequest
{
PolicyDocument = policyDocument,
PolicyName = policyName,
});
return response.Policy;
}
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreatePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_create_policy
#
# This function creates an IAM policy.
#
# Parameters:
# -n policy_name -- The name of the IAM policy.
# -p policy_json -- The policy document.
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_create_policy() {
local policy_name policy_document response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_create_policy"
echo "Creates an AWS Identity and Access Management (IAM) policy."
echo " -n policy_name The name of the IAM policy."
echo " -p policy_json -- The policy document."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:p:h" option; do
case "${option}" in
n) policy_name="${OPTARG}" ;;
p) policy_document="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$policy_name" ]]; then
errecho "ERROR: You must provide a policy name with the -n parameter."
usage
return 1
fi
if [[ -z "$policy_document" ]]; then
errecho "ERROR: You must provide a policy document with the -p parameter."
usage
return 1
fi
response=$(aws iam create-policy \
--policy-name "$policy_name" \
--policy-document "$policy_document" \
--output text \
--query Policy.Arn)
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-policy operation failed.\n$response"
return 1
fi
echo "$response"
}
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/CreatePolicy) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::String AwsDoc::IAM::createPolicy(const Aws::String &policyName,
const Aws::String &rsrcArn,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::CreatePolicyRequest request;
request.SetPolicyName(policyName);
request.SetPolicyDocument(BuildSamplePolicyDocument(rsrcArn));
Aws::IAM::Model::CreatePolicyOutcome outcome = iam.CreatePolicy(request);
Aws::String result;
if (!outcome.IsSuccess()) {
std::cerr << "Error creating policy " << policyName << ": " <<
outcome.GetError().GetMessage() << std::endl;
}
else {
result = outcome.GetResult().GetPolicy().GetArn();
std::cout << "Successfully created policy " << policyName <<
std::endl;
}
return result;
}
Aws::String AwsDoc::IAM::BuildSamplePolicyDocument(const Aws::String &rsrc_arn) {
std::stringstream stringStream;
stringStream << "{"
<< " \"Version\": \"2012-10-17\","
<< " \"Statement\": ["
<< " {"
<< " \"Effect\": \"Allow\","
<< " \"Action\": \"logs:CreateLogGroup\","
<< " \"Resource\": \""
<< rsrc_arn
<< "\""
<< " },"
<< " {"
<< " \"Effect\": \"Allow\","
<< " \"Action\": ["
<< " \"dynamodb:DeleteItem\","
<< " \"dynamodb:GetItem\","
<< " \"dynamodb:PutItem\","
<< " \"dynamodb:Scan\","
<< " \"dynamodb:UpdateItem\""
<< " ],"
<< " \"Resource\": \""
<< rsrc_arn
<< "\""
<< " }"
<< " ]"
<< "}";
return stringStream.str();
}
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/CreatePolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To create a customer managed policy**
The following command creates a customer managed policy named `my-policy`. The file `policy.json` is a JSON document in the current folder that grants read only access to the `shared` folder in an Amazon S3 bucket named `amzn-s3-demo-bucket`.
```
aws iam create-policy \
--policy-name my-policy \
--policy-document file://policy.json
```
Contents of policy.json:
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket/shared/*"
]
}
]
}
```
Output:
```
{
"Policy": {
"PolicyName": "my-policy",
"CreateDate": "2015-06-01T19:31:18.620Z",
"AttachmentCount": 0,
"IsAttachable": true,
"PolicyId": "ZXR6A36LTYANPAI7NJ5UV",
"DefaultVersionId": "v1",
"Path": "/",
"Arn": "arn:aws:iam::0123456789012:policy/my-policy",
"UpdateDate": "2015-06-01T19:31:18.620Z"
}
}
```
For more information on using files as input for string parameters, see [Specify parameter values for the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-parameters.html) in the *AWS CLI User Guide*.
**Example 2: To create a customer managed policy with a description**
The following command creates a customer managed policy named `my-policy` with an immutable description.
The file `policy.json` is a JSON document in the current folder that grants access to all Put, List, and Get actions for an Amazon S3 bucket named `amzn-s3-demo-bucket`.
```
aws iam create-policy \
--policy-name my-policy \
--policy-document file://policy.json \
--description "This policy grants access to all Put, Get, and List actions for amzn-s3-demo-bucket"
```
Contents of policy.json:
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket*",
"s3:PutBucket*",
"s3:GetBucket*"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket"
]
}
]
}
```
Output:
```
{
"Policy": {
"PolicyName": "my-policy",
"PolicyId": "ANPAWGSUGIDPEXAMPLE",
"Arn": "arn:aws:iam::123456789012:policy/my-policy",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2023-05-24T22:38:47+00:00",
"UpdateDate": "2023-05-24T22:38:47+00:00"
}
}
```
For more information on Idenity-based Policies, see [Identity-based policies and resource-based policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html) in the *AWS IAM User Guide*.
**Example 3: To create a customer managed policy with tags**
The following command creates a customer managed policy named `my-policy` with tags. This example uses the `--tags` parameter with the following JSON-formatted tags: `'{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'`. Alternatively, the `--tags` parameter can be used with tags in the shorthand format: `'Key=Department,Value=Accounting Key=Location,Value=Seattle'`.
The file `policy.json` is a JSON document in the current folder that grants access to all Put, List, and Get actions for an Amazon S3 bucket named `amzn-s3-demo-bucket`.
```
aws iam create-policy \
--policy-name my-policy \
--policy-document file://policy.json \
--tags '{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'
```
Contents of policy.json:
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket*",
"s3:PutBucket*",
"s3:GetBucket*"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket"
]
}
]
}
```
Output:
```
{
"Policy": {
"PolicyName": "my-policy",
"PolicyId": "ANPAWGSUGIDPEXAMPLE",
"Arn": "arn:aws:iam::12345678012:policy/my-policy",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2023-05-24T23:16:39+00:00",
"UpdateDate": "2023-05-24T23:16:39+00:00",
"Tags": [
{
"Key": "Department",
"Value": "Accounting"
},
"Key": "Location",
"Value": "Seattle"
{
]
}
}
```
For more information on Tagging policies, see [Tagging customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags_customer-managed-policies.html) in the *AWS IAM User Guide*.
+ For API details, see [CreatePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// PolicyWrapper encapsulates AWS Identity and Access Management (IAM) policy actions
// used in the examples.
// It contains an IAM service client that is used to perform policy actions.
type PolicyWrapper struct {
IamClient *iam.Client
}
// PolicyDocument defines a policy document as a Go struct that can be serialized
// to JSON.
type PolicyDocument struct {
Version string
Statement []PolicyStatement
}
// PolicyStatement defines a statement in a policy document.
type PolicyStatement struct {
Effect string
Action []string
Principal map[string]string `json:",omitempty"`
Resource *string `json:",omitempty"`
}
// CreatePolicy creates a policy that grants a list of actions to the specified resource.
// PolicyDocument shows how to work with a policy document as a data structure and
// serialize it to JSON by using Go's JSON marshaler.
func (wrapper PolicyWrapper) CreatePolicy(ctx context.Context, policyName string, actions []string,
resourceArn string) (*types.Policy, error) {
var policy *types.Policy
policyDoc := PolicyDocument{
Version: "2012-10-17",
Statement: []PolicyStatement{{
Effect: "Allow",
Action: actions,
Resource: aws.String(resourceArn),
}},
}
policyBytes, err := json.Marshal(policyDoc)
if err != nil {
log.Printf("Couldn't create policy document for %v. Here's why: %v\n", resourceArn, err)
return nil, err
}
result, err := wrapper.IamClient.CreatePolicy(ctx, &iam.CreatePolicyInput{
PolicyDocument: aws.String(string(policyBytes)),
PolicyName: aws.String(policyName),
})
if err != nil {
log.Printf("Couldn't create policy %v. Here's why: %v\n", policyName, err)
} else {
policy = result.Policy
}
return policy, err
}
```
+ For API details, see [CreatePolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreatePolicy) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.core.waiters.WaiterResponse;
import software.amazon.awssdk.services.iam.model.CreatePolicyRequest;
import software.amazon.awssdk.services.iam.model.CreatePolicyResponse;
import software.amazon.awssdk.services.iam.model.GetPolicyRequest;
import software.amazon.awssdk.services.iam.model.GetPolicyResponse;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.waiters.IamWaiter;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreatePolicy {
public static final String PolicyDocument = "{" +
" \"Version\": \"2012-10-17\"," +
" \"Statement\": [" +
" {" +
" \"Effect\": \"Allow\"," +
" \"Action\": [" +
" \"dynamodb:DeleteItem\"," +
" \"dynamodb:GetItem\"," +
" \"dynamodb:PutItem\"," +
" \"dynamodb:Scan\"," +
" \"dynamodb:UpdateItem\"" +
" ]," +
" \"Resource\": \"*\"" +
" }" +
" ]" +
"}";
public static void main(String[] args) {
final String usage = """
Usage:
CreatePolicy \s
Where:
policyName - A unique policy name.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String policyName = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
String result = createIAMPolicy(iam, policyName);
System.out.println("Successfully created a policy with this ARN value: " + result);
iam.close();
}
public static String createIAMPolicy(IamClient iam, String policyName) {
try {
// Create an IamWaiter object.
IamWaiter iamWaiter = iam.waiter();
CreatePolicyRequest request = CreatePolicyRequest.builder()
.policyName(policyName)
.policyDocument(PolicyDocument)
.build();
CreatePolicyResponse response = iam.createPolicy(request);
// Wait until the policy is created.
GetPolicyRequest polRequest = GetPolicyRequest.builder()
.policyArn(response.policy().arn())
.build();
WaiterResponse waitUntilPolicyExists = iamWaiter.waitUntilPolicyExists(polRequest);
waitUntilPolicyExists.matched().response().ifPresent(System.out::println);
return response.policy().arn();
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
return "";
}
}
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/CreatePolicy) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the policy.
```
import { CreatePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} policyName
*/
export const createPolicy = (policyName) => {
const command = new CreatePolicyCommand({
PolicyDocument: JSON.stringify({
Version: "2012-10-17",
Statement: [
{
Effect: "Allow",
Action: "*",
Resource: "*",
},
],
}),
PolicyName: policyName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-policies.html#iam-examples-policies-creating).
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreatePolicyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var myManagedPolicy = {
Version: "2012-10-17",
Statement: [
{
Effect: "Allow",
Action: "logs:CreateLogGroup",
Resource: "RESOURCE_ARN",
},
{
Effect: "Allow",
Action: [
"dynamodb:DeleteItem",
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:Scan",
"dynamodb:UpdateItem",
],
Resource: "RESOURCE_ARN",
},
],
};
var params = {
PolicyDocument: JSON.stringify(myManagedPolicy),
PolicyName: "myDynamoDBPolicy",
};
iam.createPolicy(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-policies.html#iam-examples-policies-creating).
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/CreatePolicy) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun createIAMPolicy(policyNameVal: String?): String {
val policyDocumentVal = """
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:DeleteItem",
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:Scan",
"dynamodb:UpdateItem"
],
"Resource": "*"
}
]
}
""".trimIndent()
val request =
CreatePolicyRequest {
policyName = policyNameVal
policyDocument = policyDocumentVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.createPolicy(request)
return response.policy?.arn.toString()
}
}
```
+ For API details, see [CreatePolicy](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
$listAllBucketsPolicyDocument = "{
\"Version\": \"2012-10-17\",
\"Statement\": [{
\"Effect\": \"Allow\",
\"Action\": \"s3:ListAllMyBuckets\",
\"Resource\": \"arn:aws:s3:::*\"}]
}";
$listAllBucketsPolicy = $service->createPolicy("iam_demo_policy_$uuid", $listAllBucketsPolicyDocument);
echo "Created policy: {$listAllBucketsPolicy['PolicyName']}\n";
/**
* @param string $policyName
* @param string $policyDocument
* @return array
*/
public function createPolicy(string $policyName, string $policyDocument)
{
$result = $this->customWaiter(function () use ($policyName, $policyDocument) {
return $this->iamClient->createPolicy([
'PolicyName' => $policyName,
'PolicyDocument' => $policyDocument,
]);
});
return $result['Policy'];
}
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/CreatePolicy) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new IAM policy in the current AWS account named `MySamplePolicy` The file `MySamplePolicy.json` provides the policy content. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file.**
```
New-IAMPolicy -PolicyName MySamplePolicy -PolicyDocument (Get-Content -Raw MySamplePolicy.json)
```
**Output:**
```
Arn : arn:aws:iam::123456789012:policy/MySamplePolicy
AttachmentCount : 0
CreateDate : 4/14/2015 2:45:59 PM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : LD4KP6HVFE7WGEXAMPLE1
PolicyName : MySamplePolicy
UpdateDate : 4/14/2015 2:45:59 PM
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new IAM policy in the current AWS account named `MySamplePolicy` The file `MySamplePolicy.json` provides the policy content. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file.**
```
New-IAMPolicy -PolicyName MySamplePolicy -PolicyDocument (Get-Content -Raw MySamplePolicy.json)
```
**Output:**
```
Arn : arn:aws:iam::123456789012:policy/MySamplePolicy
AttachmentCount : 0
CreateDate : 4/14/2015 2:45:59 PM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : LD4KP6HVFE7WGEXAMPLE1
PolicyName : MySamplePolicy
UpdateDate : 4/14/2015 2:45:59 PM
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_policy(name, description, actions, resource_arn):
"""
Creates a policy that contains a single statement.
:param name: The name of the policy to create.
:param description: The description of the policy.
:param actions: The actions allowed by the policy. These typically take the
form of service:action, such as s3:PutObject.
:param resource_arn: The Amazon Resource Name (ARN) of the resource this policy
applies to. This ARN can contain wildcards, such as
'arn:aws:s3:::amzn-s3-demo-bucket/*' to allow actions on all objects
in the bucket named 'amzn-s3-demo-bucket'.
:return: The newly created policy.
"""
policy_doc = {
"Version":"2012-10-17",
"Statement": [{"Effect": "Allow", "Action": actions, "Resource": resource_arn}],
}
try:
policy = iam.create_policy(
PolicyName=name,
Description=description,
PolicyDocument=json.dumps(policy_doc),
)
logger.info("Created policy %s.", policy.arn)
except ClientError:
logger.exception("Couldn't create policy %s.", name)
raise
else:
return policy
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreatePolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, attaches, and detaches role policies.
```
# Manages policies in AWS Identity and Access Management (IAM)
class RolePolicyManager
# Initialize with an AWS IAM client
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'PolicyManager'
end
# Creates a policy
#
# @param policy_name [String] The name of the policy
# @param policy_document [Hash] The policy document
# @return [String] The policy ARN if successful, otherwise nil
def create_policy(policy_name, policy_document)
response = @iam_client.create_policy(
policy_name: policy_name,
policy_document: policy_document.to_json
)
response.policy.arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating policy: #{e.message}")
nil
end
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
# Attaches a policy to a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_role(role_name, policy_arn)
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to role: #{e.message}")
false
end
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
# Detaches a policy from a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def detach_policy_from_role(role_name, policy_arn)
@iam_client.detach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from role: #{e.message}")
false
end
end
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreatePolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_policy(
client: &iamClient,
policy_name: &str,
policy_document: &str,
) -> Result {
let policy = client
.create_policy()
.policy_name(policy_name)
.policy_document(policy_document)
.send()
.await?;
Ok(policy.policy.unwrap())
}
```
+ For API details, see [CreatePolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createpolicy(
iv_policyname = iv_policy_name
iv_policydocument = iv_policy_document
iv_description = iv_description ).
MESSAGE 'Policy created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamentityalrdyexex.
MESSAGE 'Policy already exists.' TYPE 'E'.
CATCH /aws1/cx_iammalformedplydocex.
MESSAGE 'Policy document is malformed.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Policy limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreatePolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createPolicy(name: String, policyDocument: String) async throws -> IAMClientTypes.Policy {
let input = CreatePolicyInput(
policyDocument: policyDocument,
policyName: name
)
do {
let output = try await iamClient.createPolicy(input: input)
guard let policy = output.policy else {
throw ServiceHandlerError.noSuchPolicy
}
return policy
} catch {
print("ERROR: createPolicy:", dump(error))
throw error
}
}
```
+ For API details, see [CreatePolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createpolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `CreatePolicyVersion` with an AWS SDK or CLI
The following code examples show how to use `CreatePolicyVersion`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
------
#### [ CLI ]
**AWS CLI**
**To create a new version of a managed policy**
This example creates a new `v2` version of the IAM policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` and makes it the default version.
```
aws iam create-policy-version \
--policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--policy-document file://NewPolicyVersion.json \
--set-as-default
```
Output:
```
{
"PolicyVersion": {
"CreateDate": "2015-06-16T18:56:03.721Z",
"VersionId": "v2",
"IsDefaultVersion": true
}
}
```
For more information, see [Versioning IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html) in the *AWS IAM User Guide*.
+ For API details, see [CreatePolicyVersion](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-policy-version.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new "v2" version of the IAM policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` and makes it the default version. The `NewPolicyVersion.json` file provides the policy content. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file.**
```
New-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyPolicy -PolicyDocument (Get-content -Raw NewPolicyVersion.json) -SetAsDefault $true
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
4/15/2015 10:54:54 AM True v2
```
+ For API details, see [CreatePolicyVersion](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new "v2" version of the IAM policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` and makes it the default version. The `NewPolicyVersion.json` file provides the policy content. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file.**
```
New-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyPolicy -PolicyDocument (Get-content -Raw NewPolicyVersion.json) -SetAsDefault $true
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
4/15/2015 10:54:54 AM True v2
```
+ For API details, see [CreatePolicyVersion](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_policy_version(policy_arn, actions, resource_arn, set_as_default):
"""
Creates a policy version. Policies can have up to five versions. The default
version is the one that is used for all resources that reference the policy.
:param policy_arn: The ARN of the policy.
:param actions: The actions to allow in the policy version.
:param resource_arn: The ARN of the resource this policy version applies to.
:param set_as_default: When True, this policy version is set as the default
version for the policy. Otherwise, the default
is not changed.
:return: The newly created policy version.
"""
policy_doc = {
"Version":"2012-10-17",
"Statement": [{"Effect": "Allow", "Action": actions, "Resource": resource_arn}],
}
try:
policy = iam.Policy(policy_arn)
policy_version = policy.create_version(
PolicyDocument=json.dumps(policy_doc), SetAsDefault=set_as_default
)
logger.info(
"Created policy version %s for policy %s.",
policy_version.version_id,
policy_version.arn,
)
except ClientError:
logger.exception("Couldn't create a policy version for %s.", policy_arn)
raise
else:
return policy_version
```
+ For API details, see [CreatePolicyVersion](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreatePolicyVersion) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createpolicyversion(
iv_policyarn = iv_policy_arn
iv_policydocument = iv_policy_document
iv_setasdefault = iv_set_as_default ).
MESSAGE 'Policy version created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iammalformedplydocex.
MESSAGE 'Policy document is malformed.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Policy version limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreatePolicyVersion](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `CreateRole` with an AWS SDK or CLI
The following code examples show how to use `CreateRole`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Configure Amazon ECS Service Connect](iam_example_ecs_ServiceConnect_085_section.md)
+ [Create a REST API with Lambda proxy integration](iam_example_api_gateway_GettingStarted_087_section.md)
+ [Create an Amazon ECS Linux task for the Fargate launch type](iam_example_ecs_GettingStarted_086_section.md)
+ [Creating a CloudWatch dashboard with function name as a variable](iam_example_cloudwatch_GettingStarted_031_section.md)
+ [Creating an Amazon ECS service for the EC2 launch type](iam_example_ecs_GettingStarted_018_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Creating your first Lambda function](iam_example_lambda_GettingStarted_019_section.md)
+ [Get started with Redshift Serverless](iam_example_redshift_GettingStarted_038_section.md)
+ [Getting started with Amazon EKS](iam_example_eks_GettingStarted_034_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Amazon Redshift provisioned clusters](iam_example_redshift_GettingStarted_039_section.md)
+ [Getting started with Amazon SageMaker Feature Store](iam_example_iam_GettingStarted_028_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage roles](iam_example_iam_Scenario_RoleManagement_section.md)
+ [Moving hardcoded secrets to Secrets Manager](iam_example_secrets_manager_GettingStarted_073_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
+ [Using property variables in CloudWatch dashboards to monitor multiple Lambda functions](iam_example_iam_GettingStarted_032_section.md)
+ [Work with Streams and Time-to-Live](iam_example_dynamodb_Scenario_StreamsAndTTL_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create a new IAM role.
///
/// The name of the IAM role.
/// The name of the IAM policy document
/// for the new role.
/// The Amazon Resource Name (ARN) of the role.
public async Task CreateRoleAsync(string roleName, string rolePolicyDocument)
{
var request = new CreateRoleRequest
{
RoleName = roleName,
AssumeRolePolicyDocument = rolePolicyDocument,
};
var response = await _IAMService.CreateRoleAsync(request);
return response.Role.Arn;
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreateRole) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_create_role
#
# This function creates an IAM role.
#
# Parameters:
# -n role_name -- The name of the IAM role.
# -p policy_json -- The assume role policy document.
#
# Returns:
# The ARN of the role.
# And:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_create_role() {
local role_name policy_document response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_create_user_access_key"
echo "Creates an AWS Identity and Access Management (IAM) role."
echo " -n role_name The name of the IAM role."
echo " -p policy_json -- The assume role policy document."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:p:h" option; do
case "${option}" in
n) role_name="${OPTARG}" ;;
p) policy_document="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$role_name" ]]; then
errecho "ERROR: You must provide a role name with the -n parameter."
usage
return 1
fi
if [[ -z "$policy_document" ]]; then
errecho "ERROR: You must provide a policy document with the -p parameter."
usage
return 1
fi
response=$(aws iam create-role \
--role-name "$role_name" \
--assume-role-policy-document "$policy_document" \
--output text \
--query Role.Arn)
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-role operation failed.\n$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/CreateRole) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::createIamRole(
const Aws::String &roleName,
const Aws::String &policy,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient client(clientConfig);
Aws::IAM::Model::CreateRoleRequest request;
request.SetRoleName(roleName);
request.SetAssumeRolePolicyDocument(policy);
Aws::IAM::Model::CreateRoleOutcome outcome = client.CreateRole(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error creating role. " <<
outcome.GetError().GetMessage() << std::endl;
}
else {
const Aws::IAM::Model::Role iamRole = outcome.GetResult().GetRole();
std::cout << "Created role " << iamRole.GetRoleName() << "\n";
std::cout << "ID: " << iamRole.GetRoleId() << "\n";
std::cout << "ARN: " << iamRole.GetArn() << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/CreateRole) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To create an IAM role**
The following `create-role` command creates a role named `Test-Role` and attaches a trust policy to it.
```
aws iam create-role \
--role-name Test-Role \
--assume-role-policy-document file://Test-Role-Trust-Policy.json
```
Output:
```
{
"Role": {
"AssumeRolePolicyDocument": "",
"RoleId": "AKIAIOSFODNN7EXAMPLE",
"CreateDate": "2013-06-07T20:43:32.821Z",
"RoleName": "Test-Role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/Test-Role"
}
}
```
The trust policy is defined as a JSON document in the *Test-Role-Trust-Policy.json* file. (The file name and extension do not have significance.) The trust policy must specify a principal.
To attach a permissions policy to a role, use the `put-role-policy` command.
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
**Example 2: To create an IAM role with specified maximum session duration**
The following `create-role` command creates a role named `Test-Role` and sets a maximum session duration of 7200 seconds (2 hours).
```
aws iam create-role \
--role-name Test-Role \
--assume-role-policy-document file://Test-Role-Trust-Policy.json \
--max-session-duration 7200
```
Output:
```
{
"Role": {
"Path": "/",
"RoleName": "Test-Role",
"RoleId": "AKIAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::12345678012:role/Test-Role",
"CreateDate": "2023-05-24T23:50:25+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::12345678012:root"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
```
For more information, see [Modifying a role maximum session duration (AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/roles-managingrole-editing-api.html#roles-modify_max-session-duration-api) in the *AWS IAM User Guide*.
**Example 3: To create an IAM Role with tags**
The following command creates an IAM Role `Test-Role` with tags. This example uses the `--tags` parameter flag with the following JSON-formatted tags: `'{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'`. Alternatively, the `--tags` flag can be used with tags in the shorthand format: `'Key=Department,Value=Accounting Key=Location,Value=Seattle'`.
```
aws iam create-role \
--role-name Test-Role \
--assume-role-policy-document file://Test-Role-Trust-Policy.json \
--tags '{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'
```
Output:
```
{
"Role": {
"Path": "/",
"RoleName": "Test-Role",
"RoleId": "AKIAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/Test-Role",
"CreateDate": "2023-05-25T23:29:41+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
},
"Tags": [
{
"Key": "Department",
"Value": "Accounting"
},
{
"Key": "Location",
"Value": "Seattle"
}
]
}
}
```
For more information, see [Tagging IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags_roles.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-role.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// CreateRole creates a role that trusts a specified user. The trusted user can assume
// the role to acquire its permissions.
// PolicyDocument shows how to work with a policy document as a data structure and
// serialize it to JSON by using Go's JSON marshaler.
func (wrapper RoleWrapper) CreateRole(ctx context.Context, roleName string, trustedUserArn string) (*types.Role, error) {
var role *types.Role
trustPolicy := PolicyDocument{
Version: "2012-10-17",
Statement: []PolicyStatement{{
Effect: "Allow",
Principal: map[string]string{"AWS": trustedUserArn},
Action: []string{"sts:AssumeRole"},
}},
}
policyBytes, err := json.Marshal(trustPolicy)
if err != nil {
log.Printf("Couldn't create trust policy for %v. Here's why: %v\n", trustedUserArn, err)
return nil, err
}
result, err := wrapper.IamClient.CreateRole(ctx, &iam.CreateRoleInput{
AssumeRolePolicyDocument: aws.String(string(policyBytes)),
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't create role %v. Here's why: %v\n", roleName, err)
} else {
role = result.Role
}
return role, err
}
```
+ For API details, see [CreateRole](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreateRole) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import software.amazon.awssdk.services.iam.model.CreateRoleRequest;
import software.amazon.awssdk.services.iam.model.CreateRoleResponse;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import java.io.FileReader;
/*
* This example requires a trust policy document. For more information, see:
* https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/
*
*
* In addition, set up your development environment, including your credentials.
*
* For information, see this documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreateRole {
public static void main(String[] args) throws Exception {
final String usage = """
Usage:
\s
Where:
rolename - The name of the role to create.\s
fileLocation - The location of the JSON document that represents the trust policy.\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String rolename = args[0];
String fileLocation = args[1];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
String result = createIAMRole(iam, rolename, fileLocation);
System.out.println("Successfully created user: " + result);
iam.close();
}
public static String createIAMRole(IamClient iam, String rolename, String fileLocation) throws Exception {
try {
JSONObject jsonObject = (JSONObject) readJsonSimpleDemo(fileLocation);
CreateRoleRequest request = CreateRoleRequest.builder()
.roleName(rolename)
.assumeRolePolicyDocument(jsonObject.toJSONString())
.description("Created using the AWS SDK for Java")
.build();
CreateRoleResponse response = iam.createRole(request);
System.out.println("The ARN of the role is " + response.role().arn());
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
return "";
}
public static Object readJsonSimpleDemo(String filename) throws Exception {
FileReader reader = new FileReader(filename);
JSONParser jsonParser = new JSONParser();
return jsonParser.parse(reader);
}
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/CreateRole) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the role.
```
import { CreateRoleCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} roleName
*/
export const createRole = (roleName) => {
const command = new CreateRoleCommand({
AssumeRolePolicyDocument: JSON.stringify({
Version: "2012-10-17",
Statement: [
{
Effect: "Allow",
Principal: {
Service: "lambda.amazonaws.com",
},
Action: "sts:AssumeRole",
},
],
}),
RoleName: roleName,
});
return client.send(command);
};
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateRoleCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
$assumeRolePolicyDocument = "{
\"Version\": \"2012-10-17\",
\"Statement\": [{
\"Effect\": \"Allow\",
\"Principal\": {\"AWS\": \"{$user['Arn']}\"},
\"Action\": \"sts:AssumeRole\"
}]
}";
$assumeRoleRole = $service->createRole("iam_demo_role_$uuid", $assumeRolePolicyDocument);
echo "Created role: {$assumeRoleRole['RoleName']}\n";
/**
* @param string $roleName
* @param string $rolePolicyDocument
* @return array
* @throws AwsException
*/
public function createRole(string $roleName, string $rolePolicyDocument)
{
$result = $this->customWaiter(function () use ($roleName, $rolePolicyDocument) {
return $this->iamClient->createRole([
'AssumeRolePolicyDocument' => $rolePolicyDocument,
'RoleName' => $roleName,
]);
});
return $result['Role'];
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/CreateRole) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new role named `MyNewRole` and attaches to it the policy found in the file `NewRoleTrustPolicy.json`. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file. The policy document displayed in the output is URL encoded. It is decoded in this example with the `UrlDecode` .NET method. **
```
$results = New-IAMRole -AssumeRolePolicyDocument (Get-Content -raw NewRoleTrustPolicy.json) -RoleName MyNewRole
$results
```
**Output:**
```
Arn : arn:aws:iam::123456789012:role/MyNewRole
AssumeRolePolicyDocument : %7B%0D%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0D%0A%20%20%22Statement%22
%3A%20%5B%0D%0A%20%20%20%20%7B%0D%0A%20%20%20%20%20%20%22Sid%22%3A%20%22%22%2C
%0D%0A%20%20%20%20%20%20%22Effect%22%3A%20%22Allow%22%2C%0D%0A%20%20%20%20%20%20
%22Principal%22%3A%20%7B%0D%0A%20%20%20%20%20%20%20%20%22AWS%22%3A%20%22arn%3Aaws
%3Aiam%3A%3A123456789012%3ADavid%22%0D%0A%20%20%20%20%20%20%7D%2C%0D%0A%20%20%20
%20%20%20%22Action%22%3A%20%22sts%3AAssumeRole%22%0D%0A%20%20%20%20%7D%0D%0A%20
%20%5D%0D%0A%7D
CreateDate : 4/15/2015 11:04:23 AM
Path : /
RoleId : V5PAJI2KPN4EAEXAMPLE1
RoleName : MyNewRole
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:David"
},
"Action": "sts:AssumeRole"
}
]
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new role named `MyNewRole` and attaches to it the policy found in the file `NewRoleTrustPolicy.json`. Note that you must use the `-Raw` switch parameter to successfully process the JSON policy file. The policy document displayed in the output is URL encoded. It is decoded in this example with the `UrlDecode` .NET method. **
```
$results = New-IAMRole -AssumeRolePolicyDocument (Get-Content -raw NewRoleTrustPolicy.json) -RoleName MyNewRole
$results
```
**Output:**
```
Arn : arn:aws:iam::123456789012:role/MyNewRole
AssumeRolePolicyDocument : %7B%0D%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0D%0A%20%20%22Statement%22
%3A%20%5B%0D%0A%20%20%20%20%7B%0D%0A%20%20%20%20%20%20%22Sid%22%3A%20%22%22%2C
%0D%0A%20%20%20%20%20%20%22Effect%22%3A%20%22Allow%22%2C%0D%0A%20%20%20%20%20%20
%22Principal%22%3A%20%7B%0D%0A%20%20%20%20%20%20%20%20%22AWS%22%3A%20%22arn%3Aaws
%3Aiam%3A%3A123456789012%3ADavid%22%0D%0A%20%20%20%20%20%20%7D%2C%0D%0A%20%20%20
%20%20%20%22Action%22%3A%20%22sts%3AAssumeRole%22%0D%0A%20%20%20%20%7D%0D%0A%20
%20%5D%0D%0A%7D
CreateDate : 4/15/2015 11:04:23 AM
Path : /
RoleId : V5PAJI2KPN4EAEXAMPLE1
RoleName : MyNewRole
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:David"
},
"Action": "sts:AssumeRole"
}
]
}
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_role(role_name, allowed_services):
"""
Creates a role that lets a list of specified services assume the role.
:param role_name: The name of the role.
:param allowed_services: The services that can assume the role.
:return: The newly created role.
"""
trust_policy = {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"Service": service},
"Action": "sts:AssumeRole",
}
for service in allowed_services
],
}
try:
role = iam.create_role(
RoleName=role_name, AssumeRolePolicyDocument=json.dumps(trust_policy)
)
logger.info("Created role %s.", role.name)
except ClientError:
logger.exception("Couldn't create role %s.", role_name)
raise
else:
return role
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateRole) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Creates a role and attaches policies to it.
#
# @param role_name [String] The name of the role.
# @param assume_role_policy_document [Hash] The trust relationship policy document.
# @param policy_arns [Array] The ARNs of the policies to attach.
# @return [String, nil] The ARN of the new role if successful, or nil if an error occurred.
def create_role(role_name, assume_role_policy_document, policy_arns)
response = @iam_client.create_role(
role_name: role_name,
assume_role_policy_document: assume_role_policy_document.to_json
)
role_arn = response.role.arn
policy_arns.each do |policy_arn|
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
end
role_arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating role: #{e.message}")
nil
end
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreateRole) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_role(
client: &iamClient,
role_name: &str,
role_policy_document: &str,
) -> Result {
let response: CreateRoleOutput = loop {
if let Ok(response) = client
.create_role()
.role_name(role_name)
.assume_role_policy_document(role_policy_document)
.send()
.await
{
break response;
}
};
Ok(response.role.unwrap())
}
```
+ For API details, see [CreateRole](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_role) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createrole(
iv_rolename = iv_role_name
iv_assumerolepolicydocument = iv_assume_role_policy_document ).
MESSAGE 'Role created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamentityalrdyexex.
MESSAGE 'Role already exists.' TYPE 'E'.
CATCH /aws1/cx_iammalformedplydocex.
MESSAGE 'Assume role policy document is malformed.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Role limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateRole](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createRole(name: String, policyDocument: String) async throws -> String {
let input = CreateRoleInput(
assumeRolePolicyDocument: policyDocument,
roleName: name
)
do {
let output = try await client.createRole(input: input)
guard let role = output.role else {
throw ServiceHandlerError.noSuchRole
}
guard let id = role.roleId else {
throw ServiceHandlerError.noSuchRole
}
return id
} catch {
print("ERROR: createRole:", dump(error))
throw error
}
}
```
+ For API details, see [CreateRole](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createrole(input:)) in *AWS SDK for Swift API reference*.
------
# Use `CreateSAMLProvider` with an AWS SDK or CLI
The following code examples show how to use `CreateSAMLProvider`.
------
#### [ CLI ]
**AWS CLI**
**To create a SAML provider**
This example creates a new SAML provider in IAM named `MySAMLProvider`. It is described by the SAML metadata document found in the file `SAMLMetaData.xml`.
```
aws iam create-saml-provider \
--saml-metadata-document file://SAMLMetaData.xml \
--name MySAMLProvider
```
Output:
```
{
"SAMLProviderArn": "arn:aws:iam::123456789012:saml-provider/MySAMLProvider"
}
```
For more information, see [Creating IAM SAML identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateSAMLProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-saml-provider.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { CreateSAMLProviderCommand, IAMClient } from "@aws-sdk/client-iam";
import { readFileSync } from "node:fs";
import * as path from "node:path";
import { dirnameFromMetaUrl } from "@aws-doc-sdk-examples/lib/utils/util-fs.js";
const client = new IAMClient({});
/**
* This sample document was generated using Auth0.
* For more information on generating this document, see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html#samlstep1.
*/
const sampleMetadataDocument = readFileSync(
path.join(
dirnameFromMetaUrl(import.meta.url),
"../../../../resources/sample_files/sample_saml_metadata.xml",
),
);
/**
*
* @param {*} providerName
* @returns
*/
export const createSAMLProvider = async (providerName) => {
const command = new CreateSAMLProviderCommand({
Name: providerName,
SAMLMetadataDocument: sampleMetadataDocument.toString(),
});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [CreateSAMLProvider](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateSAMLProviderCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new SAML provider entity in IAM. It is named `MySAMLProvider` and is described by the SAML metadata document found in the file `SAMLMetaData.xml`, which was separately downloaded from the SAML service provider's web site.**
```
New-IAMSAMLProvider -Name MySAMLProvider -SAMLMetadataDocument (Get-Content -Raw SAMLMetaData.xml)
```
**Output:**
```
arn:aws:iam::123456789012:saml-provider/MySAMLProvider
```
+ For API details, see [CreateSAMLProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new SAML provider entity in IAM. It is named `MySAMLProvider` and is described by the SAML metadata document found in the file `SAMLMetaData.xml`, which was separately downloaded from the SAML service provider's web site.**
```
New-IAMSAMLProvider -Name MySAMLProvider -SAMLMetadataDocument (Get-Content -Raw SAMLMetaData.xml)
```
**Output:**
```
arn:aws:iam::123456789012:saml-provider/MySAMLProvider
```
+ For API details, see [CreateSAMLProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `CreateServiceLinkedRole` with an AWS SDK or CLI
The following code examples show how to use `CreateServiceLinkedRole`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create an IAM service-linked role.
///
/// The name of the AWS Service.
/// A description of the IAM service-linked role.
/// The IAM role that was created.
public async Task CreateServiceLinkedRoleAsync(string serviceName, string description)
{
var request = new CreateServiceLinkedRoleRequest
{
AWSServiceName = serviceName,
Description = description
};
var response = await _IAMService.CreateServiceLinkedRoleAsync(request);
return response.Role;
}
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreateServiceLinkedRole) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To create a service-linked role**
The following `create-service-linked-role` example creates a service-linked role for the specified AWS service and attaches the specified description.
```
aws iam create-service-linked-role \
--aws-service-name lex.amazonaws.com \
--description "My service-linked role to support Lex"
```
Output:
```
{
"Role": {
"Path": "/aws-service-role/lex.amazonaws.com/",
"RoleName": "AWSServiceRoleForLexBots",
"RoleId": "AROA1234567890EXAMPLE",
"Arn": "arn:aws:iam::1234567890:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots",
"CreateDate": "2019-04-17T20:34:14+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"sts:AssumeRole"
],
"Effect": "Allow",
"Principal": {
"Service": [
"lex.amazonaws.com"
]
}
}
]
}
}
}
```
For more information, see [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateServiceLinkedRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-service-linked-role.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// CreateServiceLinkedRole creates a service-linked role that is owned by the specified service.
func (wrapper RoleWrapper) CreateServiceLinkedRole(ctx context.Context, serviceName string, description string) (
*types.Role, error) {
var role *types.Role
result, err := wrapper.IamClient.CreateServiceLinkedRole(ctx, &iam.CreateServiceLinkedRoleInput{
AWSServiceName: aws.String(serviceName),
Description: aws.String(description),
})
if err != nil {
log.Printf("Couldn't create service-linked role %v. Here's why: %v\n", serviceName, err)
} else {
role = result.Role
}
return role, err
}
```
+ For API details, see [CreateServiceLinkedRole](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreateServiceLinkedRole) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create a service-linked role.
```
import {
CreateServiceLinkedRoleCommand,
GetRoleCommand,
IAMClient,
} from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} serviceName
*/
export const createServiceLinkedRole = async (serviceName) => {
const command = new CreateServiceLinkedRoleCommand({
// For a list of AWS services that support service-linked roles,
// see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html.
//
// For a list of AWS service endpoints, see https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html.
AWSServiceName: serviceName,
});
try {
const response = await client.send(command);
console.log(response);
return response;
} catch (caught) {
if (
caught instanceof Error &&
caught.name === "InvalidInputException" &&
caught.message.includes(
"Service role name AWSServiceRoleForElasticBeanstalk has been taken in this account",
)
) {
console.warn(caught.message);
return client.send(
new GetRoleCommand({ RoleName: "AWSServiceRoleForElasticBeanstalk" }),
);
}
throw caught;
}
};
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateServiceLinkedRoleCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function createServiceLinkedRole($awsServiceName, $customSuffix = "", $description = "")
{
$createServiceLinkedRoleArguments = ['AWSServiceName' => $awsServiceName];
if ($customSuffix) {
$createServiceLinkedRoleArguments['CustomSuffix'] = $customSuffix;
}
if ($description) {
$createServiceLinkedRoleArguments['Description'] = $description;
}
return $this->iamClient->createServiceLinkedRole($createServiceLinkedRoleArguments);
}
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/CreateServiceLinkedRole) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a servicelinked role for autoscaling service.**
```
New-IAMServiceLinkedRole -AWSServiceName autoscaling.amazonaws.com -CustomSuffix RoleNameEndsWithThis -Description "My service-linked role to support autoscaling"
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a servicelinked role for autoscaling service.**
```
New-IAMServiceLinkedRole -AWSServiceName autoscaling.amazonaws.com -CustomSuffix RoleNameEndsWithThis -Description "My service-linked role to support autoscaling"
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_service_linked_role(service_name, description):
"""
Creates a service-linked role.
:param service_name: The name of the service that owns the role.
:param description: A description to give the role.
:return: The newly created role.
"""
try:
response = iam.meta.client.create_service_linked_role(
AWSServiceName=service_name, Description=description
)
role = iam.Role(response["Role"]["RoleName"])
logger.info("Created service-linked role %s.", role.name)
except ClientError:
logger.exception("Couldn't create service-linked role for %s.", service_name)
raise
else:
return role
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateServiceLinkedRole) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Creates a service-linked role
#
# @param service_name [String] The service name to create the role for.
# @param description [String] The description of the service-linked role.
# @param suffix [String] Suffix for customizing role name.
# @return [String] The name of the created role
def create_service_linked_role(service_name, description, suffix)
response = @iam_client.create_service_linked_role(
aws_service_name: service_name, description: description, custom_suffix: suffix
)
role_name = response.role.role_name
@logger.info("Created service-linked role #{role_name}.")
role_name
rescue Aws::Errors::ServiceError => e
@logger.error("Couldn't create service-linked role for #{service_name}. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreateServiceLinkedRole) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_service_linked_role(
client: &iamClient,
aws_service_name: String,
custom_suffix: Option,
description: Option,
) -> Result> {
let response = client
.create_service_linked_role()
.aws_service_name(aws_service_name)
.set_custom_suffix(custom_suffix)
.set_description(description)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [CreateServiceLinkedRole](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_service_linked_role) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listpolicyversions(
iv_policyarn = iv_policy_arn ).
MESSAGE 'Retrieved policy versions list.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing policy versions.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateServiceLinkedRole](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createServiceLinkedRole(service: String, suffix: String? = nil, description: String?)
async throws -> IAMClientTypes.Role {
let input = CreateServiceLinkedRoleInput(
awsServiceName: service,
customSuffix: suffix,
description: description
)
do {
let output = try await client.createServiceLinkedRole(input: input)
guard let role = output.role else {
throw ServiceHandlerError.noSuchRole
}
return role
} catch {
print("ERROR: createServiceLinkedRole:", dump(error))
throw error
}
}
```
+ For API details, see [CreateServiceLinkedRole](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createservicelinkedrole(input:)) in *AWS SDK for Swift API reference*.
------
# Use `CreateUser` with an AWS SDK or CLI
The following code examples show how to use `CreateUser`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create an IAM user.
///
/// The username for the new IAM user.
/// The IAM user that was created.
public async Task CreateUserAsync(string userName)
{
var response = await _IAMService.CreateUserAsync(new CreateUserRequest { UserName = userName });
return response.User;
}
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/CreateUser) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function iecho
#
# This function enables the script to display the specified text only if
# the global variable $VERBOSE is set to true.
###############################################################################
function iecho() {
if [[ $VERBOSE == true ]]; then
echo "$@"
fi
}
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_create_user
#
# This function creates the specified IAM user, unless
# it already exists.
#
# Parameters:
# -u user_name -- The name of the user to create.
#
# Returns:
# The ARN of the user.
# And:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_create_user() {
local user_name response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_create_user"
echo "Creates an AWS Identity and Access Management (IAM) user. You must supply a username:"
echo " -u user_name The name of the user. It must be unique within the account."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
iecho "Parameters:\n"
iecho " User name: $user_name"
iecho ""
# If the user already exists, we don't want to try to create it.
if (iam_user_exists "$user_name"); then
errecho "ERROR: A user with that name already exists in the account."
return 1
fi
response=$(aws iam create-user --user-name "$user_name" \
--output text \
--query 'User.Arn')
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-user operation failed.$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/CreateUser) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::CreateUserRequest create_request;
create_request.SetUserName(userName);
auto create_outcome = iam.CreateUser(create_request);
if (!create_outcome.IsSuccess()) {
std::cerr << "Error creating IAM user " << userName << ":" <<
create_outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully created IAM user " << userName << std::endl;
}
return create_outcome.IsSuccess();
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/CreateUser) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To create an IAM user**
The following `create-user` command creates an IAM user named `Bob` in the current account.
```
aws iam create-user \
--user-name Bob
```
Output:
```
{
"User": {
"UserName": "Bob",
"Path": "/",
"CreateDate": "2023-06-08T03:20:41.270Z",
"UserId": "AIDAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::123456789012:user/Bob"
}
}
```
For more information, see [Creating an IAM user in your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) in the *AWS IAM User Guide*.
**Example 2: To create an IAM user at a specified path**
The following `create-user` command creates an IAM user named `Bob` at the specified path.
```
aws iam create-user \
--user-name Bob \
--path /division_abc/subdivision_xyz/
```
Output:
```
{
"User": {
"Path": "/division_abc/subdivision_xyz/",
"UserName": "Bob",
"UserId": "AIDAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::12345678012:user/division_abc/subdivision_xyz/Bob",
"CreateDate": "2023-05-24T18:20:17+00:00"
}
}
```
For more information, see [IAM identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html) in the *AWS IAM User Guide*.
**Example 3: To Create an IAM User with tags**
The following `create-user` command creates an IAM user named `Bob` with tags. This example uses the `--tags` parameter flag with the following JSON-formatted tags: `'{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'`. Alternatively, the `--tags` flag can be used with tags in the shorthand format: `'Key=Department,Value=Accounting Key=Location,Value=Seattle'`.
```
aws iam create-user \
--user-name Bob \
--tags '{"Key": "Department", "Value": "Accounting"}' '{"Key": "Location", "Value": "Seattle"}'
```
Output:
```
{
"User": {
"Path": "/",
"UserName": "Bob",
"UserId": "AIDAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::12345678012:user/Bob",
"CreateDate": "2023-05-25T17:14:21+00:00",
"Tags": [
{
"Key": "Department",
"Value": "Accounting"
},
{
"Key": "Location",
"Value": "Seattle"
}
]
}
}
```
For more information, see [Tagging IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags_users.html) in the *AWS IAM User Guide*.
**Example 3: To create an IAM user with a set permissions boundary**
The following `create-user` command creates an IAM user named `Bob` with the permissions boundary of AmazonS3FullAccess.
```
aws iam create-user \
--user-name Bob \
--permissions-boundary arn:aws:iam::aws:policy/AmazonS3FullAccess
```
Output:
```
{
"User": {
"Path": "/",
"UserName": "Bob",
"UserId": "AIDAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::12345678012:user/Bob",
"CreateDate": "2023-05-24T17:50:53+00:00",
"PermissionsBoundary": {
"PermissionsBoundaryType": "Policy",
"PermissionsBoundaryArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}
}
}
```
For more information, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-user.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// CreateUser creates a new user with the specified name.
func (wrapper UserWrapper) CreateUser(ctx context.Context, userName string) (*types.User, error) {
var user *types.User
result, err := wrapper.IamClient.CreateUser(ctx, &iam.CreateUserInput{
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't create user %v. Here's why: %v\n", userName, err)
} else {
user = result.User
}
return user, err
}
```
+ For API details, see [CreateUser](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreateUser) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.core.waiters.WaiterResponse;
import software.amazon.awssdk.services.iam.model.CreateUserRequest;
import software.amazon.awssdk.services.iam.model.CreateUserResponse;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.waiters.IamWaiter;
import software.amazon.awssdk.services.iam.model.GetUserRequest;
import software.amazon.awssdk.services.iam.model.GetUserResponse;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreateUser {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
username - The name of the user to create.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String username = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
String result = createIAMUser(iam, username);
System.out.println("Successfully created user: " + result);
iam.close();
}
public static String createIAMUser(IamClient iam, String username) {
try {
// Create an IamWaiter object.
IamWaiter iamWaiter = iam.waiter();
CreateUserRequest request = CreateUserRequest.builder()
.userName(username)
.build();
CreateUserResponse response = iam.createUser(request);
// Wait until the user is created.
GetUserRequest userRequest = GetUserRequest.builder()
.userName(response.user().userName())
.build();
WaiterResponse waitUntilUserExists = iamWaiter.waitUntilUserExists(userRequest);
waitUntilUserExists.matched().response().ifPresent(System.out::println);
return response.user().userName();
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
return "";
}
}
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/CreateUser) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the user.
```
import { CreateUserCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} name
*/
export const createUser = (name) => {
const command = new CreateUserCommand({ UserName: name });
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-creating-users).
+ For API details, see [CreateUser](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateUserCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
UserName: process.argv[2],
};
iam.getUser(params, function (err, data) {
if (err && err.code === "NoSuchEntity") {
iam.createUser(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
} else {
console.log(
"User " + process.argv[2] + " already exists",
data.User.UserId
);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-creating-users).
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/CreateUser) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun createIAMUser(usernameVal: String?): String? {
val request =
CreateUserRequest {
userName = usernameVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.createUser(request)
return response.user?.userName
}
}
```
+ For API details, see [CreateUser](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
$user = $service->createUser("iam_demo_user_$uuid");
echo "Created user with the arn: {$user['Arn']}\n";
/**
* @param string $name
* @return array
* @throws AwsException
*/
public function createUser(string $name): array
{
$result = $this->iamClient->createUser([
'UserName' => $name,
]);
return $result['User'];
}
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/CreateUser) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates an IAM user named `Bob`. If Bob needs to sign in to the AWS console, then you must separately run the command `New-IAMLoginProfile` to create a sign-in profile with a password. If Bob needs to run AWS PowerShell or cross-platform CLI commands or make AWS API calls, then you must separately run the `New-IAMAccessKey` command to create access keys.**
```
New-IAMUser -UserName Bob
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/22/2015 12:02:11 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : AIDAJWGEFDMEMEXAMPLE1
UserName : Bob
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates an IAM user named `Bob`. If Bob needs to sign in to the AWS console, then you must separately run the command `New-IAMLoginProfile` to create a sign-in profile with a password. If Bob needs to run AWS PowerShell or cross-platform CLI commands or make AWS API calls, then you must separately run the `New-IAMAccessKey` command to create access keys.**
```
New-IAMUser -UserName Bob
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/22/2015 12:02:11 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : AIDAJWGEFDMEMEXAMPLE1
UserName : Bob
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_user(user_name):
"""
Creates a user. By default, a user has no permissions or access keys.
:param user_name: The name of the user.
:return: The newly created user.
"""
try:
user = iam.create_user(UserName=user_name)
logger.info("Created user %s.", user.name)
except ClientError:
logger.exception("Couldn't create user %s.", user_name)
raise
else:
return user
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/CreateUser) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Creates a user and their login profile
#
# @param user_name [String] The name of the user
# @param initial_password [String] The initial password for the user
# @return [String, nil] The ID of the user if created, or nil if an error occurred
def create_user(user_name, initial_password)
response = @iam_client.create_user(user_name: user_name)
@iam_client.wait_until(:user_exists, user_name: user_name)
@iam_client.create_login_profile(
user_name: user_name,
password: initial_password,
password_reset_required: true
)
@logger.info("User '#{user_name}' created successfully.")
response.user.user_id
rescue Aws::IAM::Errors::EntityAlreadyExists
@logger.error("Error creating user '#{user_name}': user already exists.")
nil
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating user '#{user_name}': #{e.message}")
nil
end
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/CreateUser) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_user(client: &iamClient, user_name: &str) -> Result {
let response = client.create_user().user_name(user_name).send().await?;
Ok(response.user.unwrap())
}
```
+ For API details, see [CreateUser](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_user) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createuser(
iv_username = iv_user_name ).
MESSAGE 'User created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamentityalrdyexex.
MESSAGE 'User already exists.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Limit exceeded for IAM users.' TYPE 'E'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Entity does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateUser](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createUser(name: String) async throws -> String {
let input = CreateUserInput(
userName: name
)
do {
let output = try await client.createUser(input: input)
guard let user = output.user else {
throw ServiceHandlerError.noSuchUser
}
guard let id = user.userId else {
throw ServiceHandlerError.noSuchUser
}
return id
} catch {
print("ERROR: createUser:", dump(error))
throw error
}
}
```
+ For API details, see [CreateUser](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createuser(input:)) in *AWS SDK for Swift API reference*.
------
# Use `CreateVirtualMfaDevice` with a CLI
The following code examples show how to use `CreateVirtualMfaDevice`.
------
#### [ CLI ]
**AWS CLI**
**To create a virtual MFA device**
This example creates a new virtual MFA device called `BobsMFADevice`. It creates a file that contains bootstrap information called `QRCode.png` and places it in the `C:/` directory. The bootstrap method used in this example is `QRCodePNG`.
```
aws iam create-virtual-mfa-device \
--virtual-mfa-device-name BobsMFADevice \
--outfile C:/QRCode.png \
--bootstrap-method QRCodePNG
```
Output:
```
{
"VirtualMFADevice": {
"SerialNumber": "arn:aws:iam::210987654321:mfa/BobsMFADevice"
}
```
For more information, see [Using multi-factor authentication (MFA) in AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) in the *AWS IAM User Guide*.
+ For API details, see [CreateVirtualMfaDevice](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-virtual-mfa-device.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new virtual MFA device. Lines 2 and 3 extract the `Base32StringSeed` value that the virtual MFA software program needs to create an account (as an alternative to the QR code). After you configure the program with the value, get two sequential authentication codes from the program. Finally, use the last command to link the virtual MFA device to the IAM user `Bob` and synchronize the account with the two authentication codes.**
```
$Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice
$SR = New-Object System.IO.StreamReader($Device.Base32StringSeed)
$base32stringseed = $SR.ReadToEnd()
$base32stringseed
CZWZMCQNW4DEXAMPLE3VOUGXJFZYSUW7EXAMPLECR4NJFD65GX2SLUDW2EXAMPLE
```
**Output:**
```
-- Pause here to enter base-32 string seed code into virtual MFA program to register account. --
Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012
```
**Example 2: This example creates a new virtual MFA device. Lines 2 and 3 extract the `QRCodePNG` value and write it to a file. This image can be scanned by the virtual MFA software program to create an account (as an alternative to manually entering the Base32StringSeed value). After you create the account in your virtual MFA program, get two sequential authentication codes and enter them in the last commands to link the virtual MFA device to the IAM user `Bob` and synchronize the account.**
```
$Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice
$BR = New-Object System.IO.BinaryReader($Device.QRCodePNG)
$BR.ReadBytes($BR.BaseStream.Length) | Set-Content -Encoding Byte -Path QRCode.png
```
**Output:**
```
-- Pause here to scan PNG with virtual MFA program to register account. --
Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012
```
+ For API details, see [CreateVirtualMfaDevice](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new virtual MFA device. Lines 2 and 3 extract the `Base32StringSeed` value that the virtual MFA software program needs to create an account (as an alternative to the QR code). After you configure the program with the value, get two sequential authentication codes from the program. Finally, use the last command to link the virtual MFA device to the IAM user `Bob` and synchronize the account with the two authentication codes.**
```
$Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice
$SR = New-Object System.IO.StreamReader($Device.Base32StringSeed)
$base32stringseed = $SR.ReadToEnd()
$base32stringseed
CZWZMCQNW4DEXAMPLE3VOUGXJFZYSUW7EXAMPLECR4NJFD65GX2SLUDW2EXAMPLE
```
**Output:**
```
-- Pause here to enter base-32 string seed code into virtual MFA program to register account. --
Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012
```
**Example 2: This example creates a new virtual MFA device. Lines 2 and 3 extract the `QRCodePNG` value and write it to a file. This image can be scanned by the virtual MFA software program to create an account (as an alternative to manually entering the Base32StringSeed value). After you create the account in your virtual MFA program, get two sequential authentication codes and enter them in the last commands to link the virtual MFA device to the IAM user `Bob` and synchronize the account.**
```
$Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice
$BR = New-Object System.IO.BinaryReader($Device.QRCodePNG)
$BR.ReadBytes($BR.BaseStream.Length) | Set-Content -Encoding Byte -Path QRCode.png
```
**Output:**
```
-- Pause here to scan PNG with virtual MFA program to register account. --
Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012
```
+ For API details, see [CreateVirtualMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeactivateMfaDevice` with a CLI
The following code examples show how to use `DeactivateMfaDevice`.
------
#### [ CLI ]
**AWS CLI**
**To deactivate an MFA device**
This command deactivates the virtual MFA device with the ARN `arn:aws:iam::210987654321:mfa/BobsMFADevice` that is associated with the user `Bob`.
```
aws iam deactivate-mfa-device \
--user-name Bob \
--serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice
```
This command produces no output.
For more information, see [Using multi-factor authentication (MFA) in AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) in the *AWS IAM User Guide*.
+ For API details, see [DeactivateMfaDevice](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/deactivate-mfa-device.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command disables the hardware MFA device associated with the user `Bob` that has the serial number `123456789012`.**
```
Disable-IAMMFADevice -UserName "Bob" -SerialNumber "123456789012"
```
**Example 2: This command disables the virtual MFA device associated with the user `David` that has the ARN `arn:aws:iam::210987654321:mfa/David`. Note that virtual MFA device is not deleted from the account. The virtual device is still present and appears in the output of the `Get-IAMVirtualMFADevice` command. Before you can create a new virtual MFA device for the same user, you must delete the old one by using the `Remove-IAMVirtualMFADevice` command.**
```
Disable-IAMMFADevice -UserName "David" -SerialNumber "arn:aws:iam::210987654321:mfa/David"
```
+ For API details, see [DeactivateMfaDevice](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command disables the hardware MFA device associated with the user `Bob` that has the serial number `123456789012`.**
```
Disable-IAMMFADevice -UserName "Bob" -SerialNumber "123456789012"
```
**Example 2: This command disables the virtual MFA device associated with the user `David` that has the ARN `arn:aws:iam::210987654321:mfa/David`. Note that virtual MFA device is not deleted from the account. The virtual device is still present and appears in the output of the `Get-IAMVirtualMFADevice` command. Before you can create a new virtual MFA device for the same user, you must delete the old one by using the `Remove-IAMVirtualMFADevice` command.**
```
Disable-IAMMFADevice -UserName "David" -SerialNumber "arn:aws:iam::210987654321:mfa/David"
```
+ For API details, see [DeactivateMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteAccessKey` with an AWS SDK or CLI
The following code examples show how to use `DeleteAccessKey`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM user's access key.
///
/// The Id for the IAM access key.
/// The username of the user that owns the IAM
/// access key.
/// A Boolean value indicating the success of the action.
public async Task DeleteAccessKeyAsync(string accessKeyId, string userName)
{
var response = await _IAMService.DeleteAccessKeyAsync(new DeleteAccessKeyRequest
{
AccessKeyId = accessKeyId,
UserName = userName,
});
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_delete_access_key
#
# This function deletes an IAM access key for the specified IAM user.
#
# Parameters:
# -u user_name -- The name of the user.
# -k access_key -- The access key to delete.
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_delete_access_key() {
local user_name access_key response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_delete_access_key"
echo "Deletes an AWS Identity and Access Management (IAM) access key for the specified IAM user"
echo " -u user_name The name of the user."
echo " -k access_key The access key to delete."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:k:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
k) access_key="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
if [[ -z "$access_key" ]]; then
errecho "ERROR: You must provide an access key with the -k parameter."
usage
return 1
fi
iecho "Parameters:\n"
iecho " Username: $user_name"
iecho " Access key: $access_key"
iecho ""
response=$(aws iam delete-access-key \
--user-name "$user_name" \
--access-key-id "$access_key")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports delete-access-key operation failed.\n$response"
return 1
fi
iecho "delete-access-key response:$response"
iecho
return 0
}
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/DeleteAccessKey) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::deleteAccessKey(const Aws::String &userName,
const Aws::String &accessKeyID,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DeleteAccessKeyRequest request;
request.SetUserName(userName);
request.SetAccessKeyId(accessKeyID);
auto outcome = iam.DeleteAccessKey(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error deleting access key " << accessKeyID << " from user "
<< userName << ": " << outcome.GetError().GetMessage() <<
std::endl;
}
else {
std::cout << "Successfully deleted access key " << accessKeyID
<< " for IAM user " << userName << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an access key for an IAM user**
The following `delete-access-key` command deletes the specified access key (access key ID and secret access key) for the IAM user named `Bob`.
```
aws iam delete-access-key \
--access-key-id AKIDPMS9RO4H3FEXAMPLE \
--user-name Bob
```
This command produces no output.
To list the access keys defined for an IAM user, use the `list-access-keys` command.
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteAccessKey](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-access-key.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// DeleteAccessKey deletes an access key from a user.
func (wrapper UserWrapper) DeleteAccessKey(ctx context.Context, userName string, keyId string) error {
_, err := wrapper.IamClient.DeleteAccessKey(ctx, &iam.DeleteAccessKeyInput{
AccessKeyId: aws.String(keyId),
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't delete access key %v. Here's why: %v\n", keyId, err)
}
return err
}
```
+ For API details, see [DeleteAccessKey](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeleteAccessKey) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.DeleteAccessKeyRequest;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class DeleteAccessKey {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
username - The name of the user.\s
accessKey - The access key ID for the secret access key you want to delete.\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String username = args[0];
String accessKey = args[1];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
deleteKey(iam, username, accessKey);
iam.close();
}
public static void deleteKey(IamClient iam, String username, String accessKey) {
try {
DeleteAccessKeyRequest request = DeleteAccessKeyRequest.builder()
.accessKeyId(accessKey)
.userName(username)
.build();
iam.deleteAccessKey(request);
System.out.println("Successfully deleted access key " + accessKey +
" from user " + username);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Delete the access key.
```
import { DeleteAccessKeyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} userName
* @param {string} accessKeyId
*/
export const deleteAccessKey = (userName, accessKeyId) => {
const command = new DeleteAccessKeyCommand({
AccessKeyId: accessKeyId,
UserName: userName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-deleting).
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteAccessKeyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
AccessKeyId: "ACCESS_KEY_ID",
UserName: "USER_NAME",
};
iam.deleteAccessKey(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-deleting).
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun deleteKey(
userNameVal: String,
accessKey: String,
) {
val request =
DeleteAccessKeyRequest {
accessKeyId = accessKey
userName = userNameVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.deleteAccessKey(request)
println("Successfully deleted access key $accessKey from $userNameVal")
}
}
```
+ For API details, see [DeleteAccessKey](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the AWS access key pair with the key ID `AKIAIOSFODNN7EXAMPLE` from the user named `Bob`.**
```
Remove-IAMAccessKey -AccessKeyId AKIAIOSFODNN7EXAMPLE -UserName Bob -Force
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the AWS access key pair with the key ID `AKIAIOSFODNN7EXAMPLE` from the user named `Bob`.**
```
Remove-IAMAccessKey -AccessKeyId AKIAIOSFODNN7EXAMPLE -UserName Bob -Force
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def delete_key(user_name, key_id):
"""
Deletes a user's access key.
:param user_name: The user that owns the key.
:param key_id: The ID of the key to delete.
"""
try:
key = iam.AccessKey(user_name, key_id)
key.delete()
logger.info("Deleted access key %s for %s.", key.id, key.user_name)
except ClientError:
logger.exception("Couldn't delete key %s for %s", key_id, user_name)
raise
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, deactivates, and deletes access keys.
```
# Manages access keys for IAM users
class AccessKeyManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'AccessKeyManager'
end
# Lists access keys for a user
#
# @param user_name [String] The name of the user.
def list_access_keys(user_name)
response = @iam_client.list_access_keys(user_name: user_name)
if response.access_key_metadata.empty?
@logger.info("No access keys found for user '#{user_name}'.")
else
response.access_key_metadata.map(&:access_key_id)
end
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Error listing access keys: cannot find user '#{user_name}'.")
[]
rescue StandardError => e
@logger.error("Error listing access keys: #{e.message}")
[]
end
# Creates an access key for a user
#
# @param user_name [String] The name of the user.
# @return [Boolean]
def create_access_key(user_name)
response = @iam_client.create_access_key(user_name: user_name)
access_key = response.access_key
@logger.info("Access key created for user '#{user_name}': #{access_key.access_key_id}")
access_key
rescue Aws::IAM::Errors::LimitExceeded
@logger.error('Error creating access key: limit exceeded. Cannot create more.')
nil
rescue StandardError => e
@logger.error("Error creating access key: #{e.message}")
nil
end
# Deactivates an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def deactivate_access_key(user_name, access_key_id)
@iam_client.update_access_key(
user_name: user_name,
access_key_id: access_key_id,
status: 'Inactive'
)
true
rescue StandardError => e
@logger.error("Error deactivating access key: #{e.message}")
false
end
# Deletes an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def delete_access_key(user_name, access_key_id)
@iam_client.delete_access_key(
user_name: user_name,
access_key_id: access_key_id
)
true
rescue StandardError => e
@logger.error("Error deleting access key: #{e.message}")
false
end
end
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteAccessKey) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_access_key(
client: &iamClient,
user: &User,
key: &AccessKey,
) -> Result<(), iamError> {
loop {
match client
.delete_access_key()
.user_name(user.user_name())
.access_key_id(key.access_key_id())
.send()
.await
{
Ok(_) => {
break;
}
Err(e) => {
println!("Can't delete the access key: {:?}", e);
sleep(Duration::from_secs(2)).await;
}
}
}
Ok(())
}
```
+ For API details, see [DeleteAccessKey](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_access_key) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deleteaccesskey(
iv_accesskeyid = iv_access_key_id
iv_username = iv_user_name ).
MESSAGE 'Access key deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Access key or user does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeleteAccessKey](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func deleteAccessKey(user: IAMClientTypes.User? = nil,
key: IAMClientTypes.AccessKey) async throws
{
let userName: String?
if user != nil {
userName = user!.userName
} else {
userName = nil
}
let input = DeleteAccessKeyInput(
accessKeyId: key.accessKeyId,
userName: userName
)
do {
_ = try await iamClient.deleteAccessKey(input: input)
} catch {
print("ERROR: deleteAccessKey:", dump(error))
throw error
}
}
```
+ For API details, see [DeleteAccessKey](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/deleteaccesskey(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DeleteAccountAlias` with an AWS SDK or CLI
The following code examples show how to use `DeleteAccountAlias`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::deleteAccountAlias(const Aws::String &accountAlias,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DeleteAccountAliasRequest request;
request.SetAccountAlias(accountAlias);
const auto outcome = iam.DeleteAccountAlias(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error deleting account alias " << accountAlias << ": "
<< outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully deleted account alias " << accountAlias <<
std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DeleteAccountAlias) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an account alias**
The following `delete-account-alias` command removes the alias `mycompany` for the current account.
```
aws iam delete-account-alias \
--account-alias mycompany
```
This command produces no output.
For more information, see [Your AWS account ID and its alias](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteAccountAlias](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-account-alias.html) in *AWS CLI Command Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.DeleteAccountAliasRequest;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class DeleteAccountAlias {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
alias - The account alias to delete.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String alias = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
deleteIAMAccountAlias(iam, alias);
iam.close();
}
public static void deleteIAMAccountAlias(IamClient iam, String alias) {
try {
DeleteAccountAliasRequest request = DeleteAccountAliasRequest.builder()
.accountAlias(alias)
.build();
iam.deleteAccountAlias(request);
System.out.println("Successfully deleted account alias " + alias);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
System.out.println("Done");
}
}
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/DeleteAccountAlias) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Delete the account alias.
```
import { DeleteAccountAliasCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} alias
*/
export const deleteAccountAlias = (alias) => {
const command = new DeleteAccountAliasCommand({ AccountAlias: alias });
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-deleting).
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteAccountAliasCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.deleteAccountAlias({ AccountAlias: process.argv[2] }, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-deleting).
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/DeleteAccountAlias) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun deleteIAMAccountAlias(alias: String) {
val request =
DeleteAccountAliasRequest {
accountAlias = alias
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.deleteAccountAlias(request)
println("Successfully deleted account alias $alias")
}
}
```
+ For API details, see [DeleteAccountAlias](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the account alias from your AWS account. The user sign in page with the alias at https://mycompanyaws.signin.aws.amazon.com/console no longer works. You must instead use the original URL with your AWS account ID number at https://.signin.aws.amazon.com/console.**
```
Remove-IAMAccountAlias -AccountAlias mycompanyaws
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the account alias from your AWS account. The user sign in page with the alias at https://mycompanyaws.signin.aws.amazon.com/console no longer works. You must instead use the original URL with your AWS account ID number at https://.signin.aws.amazon.com/console.**
```
Remove-IAMAccountAlias -AccountAlias mycompanyaws
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def delete_alias(alias):
"""
Removes the alias from the current account.
:param alias: The alias to remove.
"""
try:
iam.meta.client.delete_account_alias(AccountAlias=alias)
logger.info("Removed alias '%s' from your account.", alias)
except ClientError:
logger.exception("Couldn't remove alias '%s' from your account.", alias)
raise
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeleteAccountAlias) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, create, and delete account aliases.
```
class IAMAliasManager
# Initializes the IAM client and logger
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client.
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
end
# Lists available AWS account aliases.
def list_aliases
response = @iam_client.list_account_aliases
if response.account_aliases.count.positive?
@logger.info('Account aliases are:')
response.account_aliases.each { |account_alias| @logger.info(" #{account_alias}") }
else
@logger.info('No account aliases found.')
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing account aliases: #{e.message}")
end
# Creates an AWS account alias.
#
# @param account_alias [String] The name of the account alias to create.
# @return [Boolean] true if the account alias was created; otherwise, false.
def create_account_alias(account_alias)
@iam_client.create_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating account alias: #{e.message}")
false
end
# Deletes an AWS account alias.
#
# @param account_alias [String] The name of the account alias to delete.
# @return [Boolean] true if the account alias was deleted; otherwise, false.
def delete_account_alias(account_alias)
@iam_client.delete_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting account alias: #{e.message}")
false
end
end
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteAccountAlias) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deleteaccountalias(
iv_accountalias = iv_account_alias ).
MESSAGE 'Account alias deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Account alias does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeleteAccountAlias](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `DeleteAccountPasswordPolicy` with a CLI
The following code examples show how to use `DeleteAccountPasswordPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To delete the current account password policy**
The following `delete-account-password-policy` command removes the password policy for the current account.
```
aws iam delete-account-password-policy
```
This command produces no output.
For more information, see [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteAccountPasswordPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-account-password-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the password policy for the AWS account and resets all values to their original defaults. If a password policy does not currently exist, the following error message appears: The account policy with name PasswordPolicy cannot be found.**
```
Remove-IAMAccountPasswordPolicy
```
+ For API details, see [DeleteAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the password policy for the AWS account and resets all values to their original defaults. If a password policy does not currently exist, the following error message appears: The account policy with name PasswordPolicy cannot be found.**
```
Remove-IAMAccountPasswordPolicy
```
+ For API details, see [DeleteAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteGroup` with an AWS SDK or CLI
The following code examples show how to use `DeleteGroup`.
------
#### [ CLI ]
**AWS CLI**
**To delete an IAM group**
The following `delete-group` command deletes an IAM group named `MyTestGroup`.
```
aws iam delete-group \
--group-name MyTestGroup
```
This command produces no output.
For more information, see [Deleting an IAM user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_delete.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { DeleteGroupCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} groupName
*/
export const deleteGroup = async (groupName) => {
const command = new DeleteGroupCommand({
GroupName: groupName,
});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [DeleteGroup](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteGroupCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the IAM group named `MyTestGroup`. The first command removes any IAM users that are members of the group, and the second command deletes the IAM group. Both commands work without any prompts for confirmation.**
```
(Get-IAMGroup -GroupName MyTestGroup).Users | Remove-IAMUserFromGroup -GroupName MyTestGroup -Force
Remove-IAMGroup -GroupName MyTestGroup -Force
```
+ For API details, see [DeleteGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the IAM group named `MyTestGroup`. The first command removes any IAM users that are members of the group, and the second command deletes the IAM group. Both commands work without any prompts for confirmation.**
```
(Get-IAMGroup -GroupName MyTestGroup).Users | Remove-IAMUserFromGroup -GroupName MyTestGroup -Force
Remove-IAMGroup -GroupName MyTestGroup -Force
```
+ For API details, see [DeleteGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteGroupPolicy` with a CLI
The following code examples show how to use `DeleteGroupPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To delete a policy from an IAM group**
The following `delete-group-policy` command deletes the policy named `ExamplePolicy` from the group named `Admins`.
```
aws iam delete-group-policy \
--group-name Admins \
--policy-name ExamplePolicy
```
This command produces no output.
To see the policies attached to a group, use the `list-group-policies` command.
For more information, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteGroupPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the inline policy named `TesterPolicy` from the IAM group `Testers`. The users in that group immediately lose the permissions defined in that policy.**
```
Remove-IAMGroupPolicy -GroupName Testers -PolicyName TestPolicy
```
+ For API details, see [DeleteGroupPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the inline policy named `TesterPolicy` from the IAM group `Testers`. The users in that group immediately lose the permissions defined in that policy.**
```
Remove-IAMGroupPolicy -GroupName Testers -PolicyName TestPolicy
```
+ For API details, see [DeleteGroupPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteInstanceProfile` with an AWS SDK or CLI
The following code examples show how to use `DeleteInstanceProfile`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Build and manage a resilient service](iam_example_cross_ResilientService_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/cross-service/ResilientService/AutoScalerActions#code-examples).
```
///
/// Detaches a role from an instance profile, detaches policies from the role,
/// and deletes all the resources.
///
/// The name of the profile to delete.
/// The name of the role to delete.
/// Async task.
public async Task DeleteInstanceProfile(string profileName, string roleName)
{
try
{
await _amazonIam.RemoveRoleFromInstanceProfileAsync(
new RemoveRoleFromInstanceProfileRequest()
{
InstanceProfileName = profileName,
RoleName = roleName
});
await _amazonIam.DeleteInstanceProfileAsync(
new DeleteInstanceProfileRequest() { InstanceProfileName = profileName });
var attachedPolicies = await _amazonIam.ListAttachedRolePoliciesAsync(
new ListAttachedRolePoliciesRequest() { RoleName = roleName });
foreach (var policy in attachedPolicies.AttachedPolicies)
{
await _amazonIam.DetachRolePolicyAsync(
new DetachRolePolicyRequest()
{
RoleName = roleName,
PolicyArn = policy.PolicyArn
});
// Delete the custom policies only.
if (!policy.PolicyArn.StartsWith("arn:aws:iam::aws"))
{
await _amazonIam.DeletePolicyAsync(
new Amazon.IdentityManagement.Model.DeletePolicyRequest()
{
PolicyArn = policy.PolicyArn
});
}
}
await _amazonIam.DeleteRoleAsync(
new DeleteRoleRequest() { RoleName = roleName });
}
catch (NoSuchEntityException)
{
Console.WriteLine($"Instance profile {profileName} does not exist.");
}
}
```
+ For API details, see [DeleteInstanceProfile](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteInstanceProfile) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an instance profile**
The following `delete-instance-profile` command deletes the instance profile named `ExampleInstanceProfile`.
```
aws iam delete-instance-profile \
--instance-profile-name ExampleInstanceProfile
```
This command produces no output.
For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteInstanceProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-instance-profile.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/cross-services/wkflw-resilient-service#code-examples).
```
const client = new IAMClient({});
await client.send(
new DeleteInstanceProfileCommand({
InstanceProfileName: NAMES.instanceProfileName,
}),
);
```
+ For API details, see [DeleteInstanceProfile](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteInstanceProfileCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the EC2 instance profile named `MyAppInstanceProfile`. The first command detaches any roles from the instance profile, and then the second command deletes the instance profile.**
```
(Get-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile).Roles | Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyAppInstanceProfile
Remove-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile
```
+ For API details, see [DeleteInstanceProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the EC2 instance profile named `MyAppInstanceProfile`. The first command detaches any roles from the instance profile, and then the second command deletes the instance profile.**
```
(Get-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile).Roles | Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyAppInstanceProfile
Remove-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile
```
+ For API details, see [DeleteInstanceProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
This example removes the role from the instance profile, detaches all policies attached to the role, and deletes all the resources.
```
class AutoScalingWrapper:
"""
Encapsulates Amazon EC2 Auto Scaling and EC2 management actions.
"""
def __init__(
self,
resource_prefix: str,
inst_type: str,
ami_param: str,
autoscaling_client: boto3.client,
ec2_client: boto3.client,
ssm_client: boto3.client,
iam_client: boto3.client,
):
"""
Initializes the AutoScaler class with the necessary parameters.
:param resource_prefix: The prefix for naming AWS resources that are created by this class.
:param inst_type: The type of EC2 instance to create, such as t3.micro.
:param ami_param: The Systems Manager parameter used to look up the AMI that is created.
:param autoscaling_client: A Boto3 EC2 Auto Scaling client.
:param ec2_client: A Boto3 EC2 client.
:param ssm_client: A Boto3 Systems Manager client.
:param iam_client: A Boto3 IAM client.
"""
self.inst_type = inst_type
self.ami_param = ami_param
self.autoscaling_client = autoscaling_client
self.ec2_client = ec2_client
self.ssm_client = ssm_client
self.iam_client = iam_client
sts_client = boto3.client("sts")
self.account_id = sts_client.get_caller_identity()["Account"]
self.key_pair_name = f"{resource_prefix}-key-pair"
self.launch_template_name = f"{resource_prefix}-template-"
self.group_name = f"{resource_prefix}-group"
# Happy path
self.instance_policy_name = f"{resource_prefix}-pol"
self.instance_role_name = f"{resource_prefix}-role"
self.instance_profile_name = f"{resource_prefix}-prof"
# Failure mode
self.bad_creds_policy_name = f"{resource_prefix}-bc-pol"
self.bad_creds_role_name = f"{resource_prefix}-bc-role"
self.bad_creds_profile_name = f"{resource_prefix}-bc-prof"
def delete_instance_profile(self, profile_name: str, role_name: str) -> None:
"""
Detaches a role from an instance profile, detaches policies from the role,
and deletes all the resources.
:param profile_name: The name of the profile to delete.
:param role_name: The name of the role to delete.
"""
try:
self.iam_client.remove_role_from_instance_profile(
InstanceProfileName=profile_name, RoleName=role_name
)
self.iam_client.delete_instance_profile(InstanceProfileName=profile_name)
log.info("Deleted instance profile %s.", profile_name)
attached_policies = self.iam_client.list_attached_role_policies(
RoleName=role_name
)
for pol in attached_policies["AttachedPolicies"]:
self.iam_client.detach_role_policy(
RoleName=role_name, PolicyArn=pol["PolicyArn"]
)
if not pol["PolicyArn"].startswith("arn:aws:iam::aws"):
self.iam_client.delete_policy(PolicyArn=pol["PolicyArn"])
log.info("Detached and deleted policy %s.", pol["PolicyName"])
self.iam_client.delete_role(RoleName=role_name)
log.info("Deleted role %s.", role_name)
except ClientError as err:
log.error(
f"Couldn't delete instance profile {profile_name} or detach "
f"policies and delete role {role_name}: {err}"
)
if err.response["Error"]["Code"] == "NoSuchEntity":
log.info(
"Instance profile %s doesn't exist, nothing to do.", profile_name
)
```
+ For API details, see [DeleteInstanceProfile](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeleteInstanceProfile) in *AWS SDK for Python (Boto3) API Reference*.
------
# Use `DeleteLoginProfile` with a CLI
The following code examples show how to use `DeleteLoginProfile`.
------
#### [ CLI ]
**AWS CLI**
**To delete a password for an IAM user**
The following `delete-login-profile` command deletes the password for the IAM user named `Bob`.
```
aws iam delete-login-profile \
--user-name Bob
```
This command produces no output.
For more information, see [Managing passwords for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteLoginProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-login-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the login profile from the IAM user named `Bob`. This prevents the user from signing-in to the AWS console. It does not prevent the user from running any AWS CLI, PowerShell, or API calls using AWS access keys that might still be attached to the user account.**
```
Remove-IAMLoginProfile -UserName Bob
```
+ For API details, see [DeleteLoginProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the login profile from the IAM user named `Bob`. This prevents the user from signing-in to the AWS console. It does not prevent the user from running any AWS CLI, PowerShell, or API calls using AWS access keys that might still be attached to the user account.**
```
Remove-IAMLoginProfile -UserName Bob
```
+ For API details, see [DeleteLoginProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteOpenIdConnectProvider` with a CLI
The following code examples show how to use `DeleteOpenIdConnectProvider`.
------
#### [ CLI ]
**AWS CLI**
**To delete an IAM OpenID Connect identity provider**
This example deletes the IAM OIDC provider that connects to the provider `example.oidcprovider.com`.
```
aws iam delete-open-id-connect-provider \
--open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
This command produces no output.
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteOpenIdConnectProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-open-id-connect-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the IAM OIDC provider that connects to the provider `example.oidcprovider.com`. Ensure that you update or delete any roles that reference this provider in the `Principal` element of the role's trust policy.**
```
Remove-IAMOpenIDConnectProvider -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [DeleteOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the IAM OIDC provider that connects to the provider `example.oidcprovider.com`. Ensure that you update or delete any roles that reference this provider in the `Principal` element of the role's trust policy.**
```
Remove-IAMOpenIDConnectProvider -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [DeleteOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeletePolicy` with an AWS SDK or CLI
The following code examples show how to use `DeletePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM policy.
///
/// The Amazon Resource Name (ARN) of the policy to
/// delete.
/// A Boolean value indicating the success of the action.
public async Task DeletePolicyAsync(string policyArn)
{
var response = await _IAMService.DeletePolicyAsync(new DeletePolicyRequest { PolicyArn = policyArn });
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeletePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function iecho
#
# This function enables the script to display the specified text only if
# the global variable $VERBOSE is set to true.
###############################################################################
function iecho() {
if [[ $VERBOSE == true ]]; then
echo "$@"
fi
}
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_delete_policy
#
# This function deletes an IAM policy.
#
# Parameters:
# -n policy_arn -- The name of the IAM policy arn.
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_delete_policy() {
local policy_arn response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_delete_policy"
echo "Deletes an AWS Identity and Access Management (IAM) policy"
echo " -n policy_arn -- The name of the IAM policy arn."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:h" option; do
case "${option}" in
n) policy_arn="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$policy_arn" ]]; then
errecho "ERROR: You must provide a policy arn with the -n parameter."
usage
return 1
fi
iecho "Parameters:\n"
iecho " Policy arn: $policy_arn"
iecho ""
response=$(aws iam delete-policy \
--policy-arn "$policy_arn")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports delete-policy operation failed.\n$response"
return 1
fi
iecho "delete-policy response:$response"
iecho
return 0
}
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/DeletePolicy) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::deletePolicy(const Aws::String &policyArn,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DeletePolicyRequest request;
request.SetPolicyArn(policyArn);
auto outcome = iam.DeletePolicy(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error deleting policy with arn " << policyArn << ": "
<< outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully deleted policy with arn " << policyArn
<< std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DeletePolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an IAM policy**
This example deletes the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.
```
aws iam delete-policy \
--policy-arn arn:aws:iam::123456789012:policy/MySamplePolicy
```
This command produces no output.
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [DeletePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// PolicyWrapper encapsulates AWS Identity and Access Management (IAM) policy actions
// used in the examples.
// It contains an IAM service client that is used to perform policy actions.
type PolicyWrapper struct {
IamClient *iam.Client
}
// DeletePolicy deletes a policy.
func (wrapper PolicyWrapper) DeletePolicy(ctx context.Context, policyArn string) error {
_, err := wrapper.IamClient.DeletePolicy(ctx, &iam.DeletePolicyInput{
PolicyArn: aws.String(policyArn),
})
if err != nil {
log.Printf("Couldn't delete policy %v. Here's why: %v\n", policyArn, err)
}
return err
}
```
+ For API details, see [DeletePolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeletePolicy) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.DeletePolicyRequest;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class DeletePolicy {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
policyARN - A policy ARN value to delete.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String policyARN = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
deleteIAMPolicy(iam, policyARN);
iam.close();
}
public static void deleteIAMPolicy(IamClient iam, String policyARN) {
try {
DeletePolicyRequest request = DeletePolicyRequest.builder()
.policyArn(policyARN)
.build();
iam.deletePolicy(request);
System.out.println("Successfully deleted the policy");
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
System.out.println("Done");
}
}
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/DeletePolicy) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam/#code-examples).
Delete the policy.
```
import { DeletePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} policyArn
*/
export const deletePolicy = (policyArn) => {
const command = new DeletePolicyCommand({ PolicyArn: policyArn });
return client.send(command);
};
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeletePolicyCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun deleteIAMPolicy(policyARNVal: String?) {
val request =
DeletePolicyRequest {
policyArn = policyARNVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.deletePolicy(request)
println("Successfully deleted $policyARNVal")
}
}
```
+ For API details, see [DeletePolicy](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`. Before you can delete the policy, you must first delete all versions except the default by running `Remove-IAMPolicyVersion`. You must also detach the policy from any IAM users, groups, or roles.**
```
Remove-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
```
**Example 2: This example deletes a policy by first deleting all the non-default policy versions, detaching it from all attached IAM entities, and finally deleting the policy itself. The first line retrieves the policy object. The second line retrieves all the policy versions that are not flagged as the default version into a collection and then deletes each policy in the collection. The third line retrieves all of the IAM users, groups, and roles to which the policy is attached. Lines four through six detach the policy from each attached entity. The last line uses this command to remove the managed policy as well as the remaining default version. The example includes the `-Force` switch parameter on any line that needs it to suppress prompts for confirmation.**
```
$pol = Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
Get-IAMPolicyVersions -PolicyArn $pol.Arn | where {-not $_.IsDefaultVersion} | Remove-IAMPolicyVersion -PolicyArn $pol.Arn -force
$attached = Get-IAMEntitiesForPolicy -PolicyArn $pol.Arn
$attached.PolicyGroups | Unregister-IAMGroupPolicy -PolicyArn $pol.arn
$attached.PolicyRoles | Unregister-IAMRolePolicy -PolicyArn $pol.arn
$attached.PolicyUsers | Unregister-IAMUserPolicy -PolicyArn $pol.arn
Remove-IAMPolicy $pol.Arn -Force
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`. Before you can delete the policy, you must first delete all versions except the default by running `Remove-IAMPolicyVersion`. You must also detach the policy from any IAM users, groups, or roles.**
```
Remove-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
```
**Example 2: This example deletes a policy by first deleting all the non-default policy versions, detaching it from all attached IAM entities, and finally deleting the policy itself. The first line retrieves the policy object. The second line retrieves all the policy versions that are not flagged as the default version into a collection and then deletes each policy in the collection. The third line retrieves all of the IAM users, groups, and roles to which the policy is attached. Lines four through six detach the policy from each attached entity. The last line uses this command to remove the managed policy as well as the remaining default version. The example includes the `-Force` switch parameter on any line that needs it to suppress prompts for confirmation.**
```
$pol = Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
Get-IAMPolicyVersions -PolicyArn $pol.Arn | where {-not $_.IsDefaultVersion} | Remove-IAMPolicyVersion -PolicyArn $pol.Arn -force
$attached = Get-IAMEntitiesForPolicy -PolicyArn $pol.Arn
$attached.PolicyGroups | Unregister-IAMGroupPolicy -PolicyArn $pol.arn
$attached.PolicyRoles | Unregister-IAMRolePolicy -PolicyArn $pol.arn
$attached.PolicyUsers | Unregister-IAMUserPolicy -PolicyArn $pol.arn
Remove-IAMPolicy $pol.Arn -Force
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def delete_policy(policy_arn):
"""
Deletes a policy.
:param policy_arn: The ARN of the policy to delete.
"""
try:
iam.Policy(policy_arn).delete()
logger.info("Deleted policy %s.", policy_arn)
except ClientError:
logger.exception("Couldn't delete policy %s.", policy_arn)
raise
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeletePolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_policy(client: &iamClient, policy: Policy) -> Result<(), iamError> {
client
.delete_policy()
.policy_arn(policy.arn.unwrap())
.send()
.await?;
Ok(())
}
```
+ For API details, see [DeletePolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deletepolicy( iv_policyarn = iv_policy_arn ).
MESSAGE 'Policy deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamdeleteconflictex.
MESSAGE 'Policy cannot be deleted due to attachments.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeletePolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func deletePolicy(policy: IAMClientTypes.Policy) async throws {
let input = DeletePolicyInput(
policyArn: policy.arn
)
do {
_ = try await iamClient.deletePolicy(input: input)
} catch {
print("ERROR: deletePolicy:", dump(error))
throw error
}
}
```
+ For API details, see [DeletePolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/deletepolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DeletePolicyVersion` with an AWS SDK or CLI
The following code examples show how to use `DeletePolicyVersion`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Roll back a policy version](iam_example_iam_Scenario_RollbackPolicyVersion_section.md)
------
#### [ CLI ]
**AWS CLI**
**To delete a version of a managed policy**
This example deletes the version identified as `v2` from the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.
```
aws iam delete-policy-version \
--policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--version-id v2
```
This command produces no output.
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [DeletePolicyVersion](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-policy-version.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the version identified as `v2` from the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.**
```
Remove-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy -VersionID v2
```
**Example 2: This example deletes a policy by first deleting all non-default policy versions and then deleting the policy itself. The first line retrieves the policy object. The second line retrieves all of the policy versions that are not flagged as the default into a collection and then uses this command to delete each policy in the collection. The last line removes the policy itself as well as the remaining default version. Note that to successfully delete a managed policy, you must also detach the policy from any users, groups, or roles by using the `Unregister-IAMUserPolicy`, `Unregister-IAMGroupPolicy`, and `Unregister-IAMRolePolicy` commands. See the example for the `Remove-IAMPolicy` cmdlet. **
```
$pol = Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
Get-IAMPolicyVersions -PolicyArn $pol.Arn | where {-not $_.IsDefaultVersion} | Remove-IAMPolicyVersion -PolicyArn $pol.Arn -force
Remove-IAMPolicy -PolicyArn $pol.Arn -force
```
+ For API details, see [DeletePolicyVersion](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the version identified as `v2` from the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.**
```
Remove-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy -VersionID v2
```
**Example 2: This example deletes a policy by first deleting all non-default policy versions and then deleting the policy itself. The first line retrieves the policy object. The second line retrieves all of the policy versions that are not flagged as the default into a collection and then uses this command to delete each policy in the collection. The last line removes the policy itself as well as the remaining default version. Note that to successfully delete a managed policy, you must also detach the policy from any users, groups, or roles by using the `Unregister-IAMUserPolicy`, `Unregister-IAMGroupPolicy`, and `Unregister-IAMRolePolicy` commands. See the example for the `Remove-IAMPolicy` cmdlet. **
```
$pol = Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
Get-IAMPolicyVersions -PolicyArn $pol.Arn | where {-not $_.IsDefaultVersion} | Remove-IAMPolicyVersion -PolicyArn $pol.Arn -force
Remove-IAMPolicy -PolicyArn $pol.Arn -force
```
+ For API details, see [DeletePolicyVersion](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deletepolicyversion(
iv_policyarn = iv_policy_arn
iv_versionid = iv_version_id ).
MESSAGE 'Policy version deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy or version does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamdeleteconflictex.
MESSAGE 'Cannot delete default policy version.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeletePolicyVersion](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `DeleteRole` with an AWS SDK or CLI
The following code examples show how to use `DeleteRole`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Configure Amazon ECS Service Connect](iam_example_ecs_ServiceConnect_085_section.md)
+ [Create a REST API with Lambda proxy integration](iam_example_api_gateway_GettingStarted_087_section.md)
+ [Creating a CloudWatch dashboard with function name as a variable](iam_example_cloudwatch_GettingStarted_031_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Creating your first Lambda function](iam_example_lambda_GettingStarted_019_section.md)
+ [Get started with Redshift Serverless](iam_example_redshift_GettingStarted_038_section.md)
+ [Getting started with Amazon EKS](iam_example_eks_GettingStarted_034_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Amazon Redshift provisioned clusters](iam_example_redshift_GettingStarted_039_section.md)
+ [Getting started with Amazon SageMaker Feature Store](iam_example_iam_GettingStarted_028_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage roles](iam_example_iam_Scenario_RoleManagement_section.md)
+ [Moving hardcoded secrets to Secrets Manager](iam_example_secrets_manager_GettingStarted_073_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
+ [Using property variables in CloudWatch dashboards to monitor multiple Lambda functions](iam_example_iam_GettingStarted_032_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM role.
///
/// The name of the IAM role to delete.
/// A Boolean value indicating the success of the action.
public async Task DeleteRoleAsync(string roleName)
{
var response = await _IAMService.DeleteRoleAsync(new DeleteRoleRequest { RoleName = roleName });
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteRole) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function iecho
#
# This function enables the script to display the specified text only if
# the global variable $VERBOSE is set to true.
###############################################################################
function iecho() {
if [[ $VERBOSE == true ]]; then
echo "$@"
fi
}
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_delete_role
#
# This function deletes an IAM role.
#
# Parameters:
# -n role_name -- The name of the IAM role.
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_delete_role() {
local role_name response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_delete_role"
echo "Deletes an AWS Identity and Access Management (IAM) role"
echo " -n role_name -- The name of the IAM role."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:h" option; do
case "${option}" in
n) role_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
echo "role_name:$role_name"
if [[ -z "$role_name" ]]; then
errecho "ERROR: You must provide a role name with the -n parameter."
usage
return 1
fi
iecho "Parameters:\n"
iecho " Role name: $role_name"
iecho ""
response=$(aws iam delete-role \
--role-name "$role_name")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports delete-role operation failed.\n$response"
return 1
fi
iecho "delete-role response:$response"
iecho
return 0
}
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/DeleteRole) in *AWS CLI Command Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an IAM role**
The following `delete-role` command removes the role named `Test-Role`.
```
aws iam delete-role \
--role-name Test-Role
```
This command produces no output.
Before you can delete a role, you must remove the role from any instance profile (`remove-role-from-instance-profile`), detach any managed policies (`detach-role-policy`) and delete any inline policies that are attached to the role (`delete-role-policy`).
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) and [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-role.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// DeleteRole deletes a role. All attached policies must be detached before a
// role can be deleted.
func (wrapper RoleWrapper) DeleteRole(ctx context.Context, roleName string) error {
_, err := wrapper.IamClient.DeleteRole(ctx, &iam.DeleteRoleInput{
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't delete role %v. Here's why: %v\n", roleName, err)
}
return err
}
```
+ For API details, see [DeleteRole](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeleteRole) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Delete the role.
```
import { DeleteRoleCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} roleName
*/
export const deleteRole = (roleName) => {
const command = new DeleteRoleCommand({ RoleName: roleName });
return client.send(command);
};
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteRoleCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the role named `MyNewRole` from the current IAM account. Before you can delete the role you must first use the `Unregister-IAMRolePolicy` command to detach any managed policies. Inline policies are deleted with the role.**
```
Remove-IAMRole -RoleName MyNewRole
```
**Example 2: This example detaches any managed policies from the role named `MyNewRole` and then deletes the role. The first line retrieves any managed policies attached to the role as a collection and then detaches each policy in the collection from the role. The second line deletes the role itself. Inline policies are deleted along with the role.**
```
Get-IAMAttachedRolePolicyList -RoleName MyNewRole | Unregister-IAMRolePolicy -RoleName MyNewRole
Remove-IAMRole -RoleName MyNewRole
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the role named `MyNewRole` from the current IAM account. Before you can delete the role you must first use the `Unregister-IAMRolePolicy` command to detach any managed policies. Inline policies are deleted with the role.**
```
Remove-IAMRole -RoleName MyNewRole
```
**Example 2: This example detaches any managed policies from the role named `MyNewRole` and then deletes the role. The first line retrieves any managed policies attached to the role as a collection and then detaches each policy in the collection from the role. The second line deletes the role itself. Inline policies are deleted along with the role.**
```
Get-IAMAttachedRolePolicyList -RoleName MyNewRole | Unregister-IAMRolePolicy -RoleName MyNewRole
Remove-IAMRole -RoleName MyNewRole
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def delete_role(role_name):
"""
Deletes a role.
:param role_name: The name of the role to delete.
"""
try:
iam.Role(role_name).delete()
logger.info("Deleted role %s.", role_name)
except ClientError:
logger.exception("Couldn't delete role %s.", role_name)
raise
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeleteRole) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Deletes a role and its attached policies.
#
# @param role_name [String] The name of the role to delete.
def delete_role(role_name)
# Detach and delete attached policies
@iam_client.list_attached_role_policies(role_name: role_name).each do |response|
response.attached_policies.each do |policy|
@iam_client.detach_role_policy({
role_name: role_name,
policy_arn: policy.policy_arn
})
# Check if the policy is a customer managed policy (not AWS managed)
unless policy.policy_arn.include?('aws:policy/')
@iam_client.delete_policy({ policy_arn: policy.policy_arn })
@logger.info("Deleted customer managed policy #{policy.policy_name}.")
end
end
end
# Delete the role
@iam_client.delete_role({ role_name: role_name })
@logger.info("Deleted role #{role_name}.")
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't detach policies and delete role #{role_name}. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteRole) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_role(client: &iamClient, role: &Role) -> Result<(), iamError> {
let role = role.clone();
while client
.delete_role()
.role_name(role.role_name())
.send()
.await
.is_err()
{
sleep(Duration::from_secs(2)).await;
}
Ok(())
}
```
+ For API details, see [DeleteRole](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_role) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deleterole( iv_rolename = iv_role_name ).
MESSAGE 'Role deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamdeleteconflictex.
MESSAGE 'Role cannot be deleted due to attached resources.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeleteRole](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func deleteRole(role: IAMClientTypes.Role) async throws {
let input = DeleteRoleInput(
roleName: role.roleName
)
do {
_ = try await iamClient.deleteRole(input: input)
} catch {
print("ERROR: deleteRole:", dump(error))
throw error
}
}
```
+ For API details, see [DeleteRole](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/deleterole(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DeleteRolePermissionsBoundary` with a CLI
The following code examples show how to use `DeleteRolePermissionsBoundary`.
------
#### [ CLI ]
**AWS CLI**
**To delete a permissions boundary from an IAM role**
The following `delete-role-permissions-boundary` example deletes the permissions boundary for the specified IAM role. To apply a permissions boundary to a role, use the `put-role-permissions-boundary` command.
```
aws iam delete-role-permissions-boundary \
--role-name lambda-application-role
```
This command produces no output.
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteRolePermissionsBoundary](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-role-permissions-boundary.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example shows how to remove the permission boundary attached to an IAM role.**
```
Remove-IAMRolePermissionsBoundary -RoleName MyRoleName
```
+ For API details, see [DeleteRolePermissionsBoundary](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example shows how to remove the permission boundary attached to an IAM role.**
```
Remove-IAMRolePermissionsBoundary -RoleName MyRoleName
```
+ For API details, see [DeleteRolePermissionsBoundary](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteRolePolicy` with an AWS SDK or CLI
The following code examples show how to use `DeleteRolePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Get started with Redshift Serverless](iam_example_redshift_GettingStarted_038_section.md)
+ [Getting started with Amazon Redshift provisioned clusters](iam_example_redshift_GettingStarted_039_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM role policy.
///
/// The name of the IAM role.
/// The name of the IAM role policy to delete.
/// A Boolean value indicating the success of the action.
public async Task DeleteRolePolicyAsync(string roleName, string policyName)
{
var response = await _IAMService.DeleteRolePolicyAsync(new DeleteRolePolicyRequest
{
PolicyName = policyName,
RoleName = roleName,
});
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeleteRolePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteRolePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To remove a policy from an IAM role**
The following `delete-role-policy` command removes the policy named `ExamplePolicy` from the role named `Test-Role`.
```
aws iam delete-role-policy \
--role-name Test-Role \
--policy-name ExamplePolicy
```
This command produces no output.
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { DeleteRolePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} roleName
* @param {string} policyName
*/
export const deleteRolePolicy = (roleName, policyName) => {
const command = new DeleteRolePolicyCommand({
RoleName: roleName,
PolicyName: policyName,
});
return client.send(command);
};
```
+ For API details, see [DeleteRolePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteRolePolicyCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the inline policy `S3AccessPolicy` that is embedded in the IAM role `S3BackupRole`.**
```
Remove-IAMRolePolicy -PolicyName S3AccessPolicy -RoleName S3BackupRole
```
+ For API details, see [DeleteRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the inline policy `S3AccessPolicy` that is embedded in the IAM role `S3BackupRole`.**
```
Remove-IAMRolePolicy -PolicyName S3AccessPolicy -RoleName S3BackupRole
```
+ For API details, see [DeleteRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteSAMLProvider` with an AWS SDK or CLI
The following code examples show how to use `DeleteSAMLProvider`.
------
#### [ CLI ]
**AWS CLI**
**To delete a SAML provider**
This example deletes the IAM SAML 2.0 provider whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider`.
```
aws iam delete-saml-provider \
--saml-provider-arn arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider
```
This command produces no output.
For more information, see [Creating IAM SAML identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteSAMLProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-saml-provider.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { DeleteSAMLProviderCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} providerArn
* @returns
*/
export const deleteSAMLProvider = async (providerArn) => {
const command = new DeleteSAMLProviderCommand({
SAMLProviderArn: providerArn,
});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [DeleteSAMLProvider](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteSAMLProviderCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the IAM SAML 2.0 provider whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider`.**
```
Remove-IAMSAMLProvider -SAMLProviderArn arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider
```
+ For API details, see [DeleteSAMLProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the IAM SAML 2.0 provider whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider`.**
```
Remove-IAMSAMLProvider -SAMLProviderArn arn:aws:iam::123456789012:saml-provider/SAMLADFSProvider
```
+ For API details, see [DeleteSAMLProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteServerCertificate` with an AWS SDK or CLI
The following code examples show how to use `DeleteServerCertificate`.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::deleteServerCertificate(const Aws::String &certificateName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DeleteServerCertificateRequest request;
request.SetServerCertificateName(certificateName);
const auto outcome = iam.DeleteServerCertificate(request);
bool result = true;
if (!outcome.IsSuccess()) {
if (outcome.GetError().GetErrorType() != Aws::IAM::IAMErrors::NO_SUCH_ENTITY) {
std::cerr << "Error deleting server certificate " << certificateName <<
": " << outcome.GetError().GetMessage() << std::endl;
result = false;
}
else {
std::cout << "Certificate '" << certificateName
<< "' not found." << std::endl;
}
}
else {
std::cout << "Successfully deleted server certificate " << certificateName
<< std::endl;
}
return result;
}
```
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DeleteServerCertificate) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete a server certificate from your AWS account**
The following `delete-server-certificate` command removes the specified server certificate from your AWS account.
```
aws iam delete-server-certificate \
--server-certificate-name myUpdatedServerCertificate
```
This command produces no output.
To list the server certificates available in your AWS account, use the `list-server-certificates` command.
For more information, see [Managing server certificates in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteServerCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-server-certificate.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Delete a server certificate.
```
import { DeleteServerCertificateCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} certName
*/
export const deleteServerCertificate = (certName) => {
const command = new DeleteServerCertificateCommand({
ServerCertificateName: certName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-deleting).
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteServerCertificateCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.deleteServerCertificate(
{ ServerCertificateName: "CERTIFICATE_NAME" },
function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
}
);
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-deleting).
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/DeleteServerCertificate) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the server certificate named `MyServerCert`.**
```
Remove-IAMServerCertificate -ServerCertificateName MyServerCert
```
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the server certificate named `MyServerCert`.**
```
Remove-IAMServerCertificate -ServerCertificateName MyServerCert
```
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, update, and delete server certificates.
```
class ServerCertificateManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'ServerCertificateManager'
end
# Creates a new server certificate.
# @param name [String] the name of the server certificate
# @param certificate_body [String] the contents of the certificate
# @param private_key [String] the private key contents
# @return [Boolean] returns true if the certificate was successfully created
def create_server_certificate(name, certificate_body, private_key)
@iam_client.upload_server_certificate({
server_certificate_name: name,
certificate_body: certificate_body,
private_key: private_key
})
true
rescue Aws::IAM::Errors::ServiceError => e
puts "Failed to create server certificate: #{e.message}"
false
end
# Lists available server certificate names.
def list_server_certificate_names
response = @iam_client.list_server_certificates
if response.server_certificate_metadata_list.empty?
@logger.info('No server certificates found.')
return
end
response.server_certificate_metadata_list.each do |certificate_metadata|
@logger.info("Certificate Name: #{certificate_metadata.server_certificate_name}")
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing server certificates: #{e.message}")
end
# Updates the name of a server certificate.
def update_server_certificate_name(current_name, new_name)
@iam_client.update_server_certificate(
server_certificate_name: current_name,
new_server_certificate_name: new_name
)
@logger.info("Server certificate name updated from '#{current_name}' to '#{new_name}'.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error updating server certificate name: #{e.message}")
false
end
# Deletes a server certificate.
def delete_server_certificate(name)
@iam_client.delete_server_certificate(server_certificate_name: name)
@logger.info("Server certificate '#{name}' deleted.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting server certificate: #{e.message}")
false
end
end
```
+ For API details, see [DeleteServerCertificate](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteServerCertificate) in *AWS SDK for Ruby API Reference*.
------
# Use `DeleteServiceLinkedRole` with an AWS SDK or CLI
The following code examples show how to use `DeleteServiceLinkedRole`.
------
#### [ CLI ]
**AWS CLI**
**To delete a service-linked role**
The following `delete-service-linked-role` example deletes the specified service-linked role that you no longer need. The deletion happens asynchronously. You can check the status of the deletion and confirm when it is done by using the `get-service-linked-role-deletion-status` command.
```
aws iam delete-service-linked-role \
--role-name AWSServiceRoleForLexBots
```
Output:
```
{
"DeletionTaskId": "task/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots/1a2b3c4d-1234-abcd-7890-abcdeEXAMPLE"
}
```
For more information, see [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteServiceLinkedRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-service-linked-role.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// DeleteServiceLinkedRole deletes a service-linked role.
func (wrapper RoleWrapper) DeleteServiceLinkedRole(ctx context.Context, roleName string) error {
_, err := wrapper.IamClient.DeleteServiceLinkedRole(ctx, &iam.DeleteServiceLinkedRoleInput{
RoleName: aws.String(roleName)},
)
if err != nil {
log.Printf("Couldn't delete service-linked role %v. Here's why: %v\n", roleName, err)
}
return err
}
```
+ For API details, see [DeleteServiceLinkedRole](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeleteServiceLinkedRole) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { DeleteServiceLinkedRoleCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} roleName
*/
export const deleteServiceLinkedRole = (roleName) => {
const command = new DeleteServiceLinkedRoleCommand({ RoleName: roleName });
return client.send(command);
};
```
+ For API details, see [DeleteServiceLinkedRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteServiceLinkedRoleCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deleted the service linked role. Please note that if the service is still using this role, then this command results in a failure.**
```
Remove-IAMServiceLinkedRole -RoleName AWSServiceRoleForAutoScaling_RoleNameEndsWithThis
```
+ For API details, see [DeleteServiceLinkedRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deleted the service linked role. Please note that if the service is still using this role, then this command results in a failure.**
```
Remove-IAMServiceLinkedRole -RoleName AWSServiceRoleForAutoScaling_RoleNameEndsWithThis
```
+ For API details, see [DeleteServiceLinkedRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Deletes a service-linked role.
#
# @param role_name [String] The name of the role to delete.
def delete_service_linked_role(role_name)
response = @iam_client.delete_service_linked_role(role_name: role_name)
task_id = response.deletion_task_id
check_deletion_status(role_name, task_id)
rescue Aws::Errors::ServiceError => e
handle_deletion_error(e, role_name)
end
private
# Checks the deletion status of a service-linked role
#
# @param role_name [String] The name of the role being deleted
# @param task_id [String] The task ID for the deletion process
def check_deletion_status(role_name, task_id)
loop do
response = @iam_client.get_service_linked_role_deletion_status(
deletion_task_id: task_id
)
status = response.status
@logger.info("Deletion of #{role_name} #{status}.")
break if %w[SUCCEEDED FAILED].include?(status)
sleep(3)
end
end
# Handles deletion error
#
# @param e [Aws::Errors::ServiceError] The error encountered during deletion
# @param role_name [String] The name of the role attempted to delete
def handle_deletion_error(e, role_name)
return if e.code == 'NoSuchEntity'
@logger.error("Couldn't delete #{role_name}. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
```
+ For API details, see [DeleteServiceLinkedRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteServiceLinkedRole) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_service_linked_role(
client: &iamClient,
role_name: &str,
) -> Result<(), iamError> {
client
.delete_service_linked_role()
.role_name(role_name)
.send()
.await?;
Ok(())
}
```
+ For API details, see [DeleteServiceLinkedRole](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_service_linked_role) in *AWS SDK for Rust API reference*.
------
# Use `DeleteSigningCertificate` with a CLI
The following code examples show how to use `DeleteSigningCertificate`.
------
#### [ CLI ]
**AWS CLI**
**To delete a signing certificate for an IAM user**
The following `delete-signing-certificate` command deletes the specified signing certificate for the IAM user named `Bob`.
```
aws iam delete-signing-certificate \
--user-name Bob \
--certificate-id TA7SMP42TDN5Z26OBPJE7EXAMPLE
```
This command produces no output.
To get the ID for a signing certificate, use the `list-signing-certificates` command.
For more information, see [Manage signing certificates](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-up-ami-tools.html#ami-tools-managing-certs) in the *Amazon EC2 User Guide*.
+ For API details, see [DeleteSigningCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-signing-certificate.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the signing certificate with the ID `Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU` from the IAM user named `Bob`.**
```
Remove-IAMSigningCertificate -UserName Bob -CertificateId Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU
```
+ For API details, see [DeleteSigningCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the signing certificate with the ID `Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU` from the IAM user named `Bob`.**
```
Remove-IAMSigningCertificate -UserName Bob -CertificateId Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU
```
+ For API details, see [DeleteSigningCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteUser` with an AWS SDK or CLI
The following code examples show how to use `DeleteUser`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM user.
///
/// The username of the IAM user to delete.
/// A Boolean value indicating the success of the action.
public async Task DeleteUserAsync(string userName)
{
var response = await _IAMService.DeleteUserAsync(new DeleteUserRequest { UserName = userName });
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteUser) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function iecho
#
# This function enables the script to display the specified text only if
# the global variable $VERBOSE is set to true.
###############################################################################
function iecho() {
if [[ $VERBOSE == true ]]; then
echo "$@"
fi
}
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_delete_user
#
# This function deletes the specified IAM user.
#
# Parameters:
# -u user_name -- The name of the user to create.
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_delete_user() {
local user_name response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_delete_user"
echo "Deletes an AWS Identity and Access Management (IAM) user. You must supply a username:"
echo " -u user_name The name of the user."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
iecho "Parameters:\n"
iecho " User name: $user_name"
iecho ""
# If the user does not exist, we don't want to try to delete it.
if (! iam_user_exists "$user_name"); then
errecho "ERROR: A user with that name does not exist in the account."
return 1
fi
response=$(aws iam delete-user \
--user-name "$user_name")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports delete-user operation failed.$response"
return 1
fi
iecho "delete-user response:$response"
iecho
return 0
}
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/DeleteUser) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DeleteUserRequest request;
request.SetUserName(userName);
auto outcome = iam.DeleteUser(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error deleting IAM user " << userName << ": " <<
outcome.GetError().GetMessage() << std::endl;;
}
else {
std::cout << "Successfully deleted IAM user " << userName << std::endl;
}
return outcome.IsSuccess();
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DeleteUser) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To delete an IAM user**
The following `delete-user` command removes the IAM user named `Bob` from the current account.
```
aws iam delete-user \
--user-name Bob
```
This command produces no output.
For more information, see [Deleting an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html#id_users_deleting) in the *AWS IAM User Guide*.
+ For API details, see [DeleteUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-user.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// DeleteUser deletes a user.
func (wrapper UserWrapper) DeleteUser(ctx context.Context, userName string) error {
_, err := wrapper.IamClient.DeleteUser(ctx, &iam.DeleteUserInput{
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't delete user %v. Here's why: %v\n", userName, err)
}
return err
}
```
+ For API details, see [DeleteUser](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeleteUser) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.DeleteUserRequest;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class DeleteUser {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
userName - The name of the user to delete.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String userName = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
deleteIAMUser(iam, userName);
System.out.println("Done");
iam.close();
}
public static void deleteIAMUser(IamClient iam, String userName) {
try {
DeleteUserRequest request = DeleteUserRequest.builder()
.userName(userName)
.build();
iam.deleteUser(request);
System.out.println("Successfully deleted IAM user " + userName);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/DeleteUser) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Delete the user.
```
import { DeleteUserCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} name
*/
export const deleteUser = (name) => {
const command = new DeleteUserCommand({ UserName: name });
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-deleting-users).
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DeleteUserCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
UserName: process.argv[2],
};
iam.getUser(params, function (err, data) {
if (err && err.code === "NoSuchEntity") {
console.log("User " + process.argv[2] + " does not exist.");
} else {
iam.deleteUser(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-deleting-users).
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/DeleteUser) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun deleteIAMUser(userNameVal: String) {
val request =
DeleteUserRequest {
userName = userNameVal
}
// To delete a user, ensure that the user's access keys are deleted first.
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.deleteUser(request)
println("Successfully deleted user $userNameVal")
}
}
```
+ For API details, see [DeleteUser](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the IAM user named `Bob`.**
```
Remove-IAMUser -UserName Bob
```
**Example 2: This example deletes the IAM user named `Theresa` along with any elements that must be deleted first.**
```
$name = "Theresa"
# find any groups and remove user from them
$groups = Get-IAMGroupForUser -UserName $name
foreach ($group in $groups) { Remove-IAMUserFromGroup -GroupName $group.GroupName -UserName $name -Force }
# find any inline policies and delete them
$inlinepols = Get-IAMUserPolicies -UserName $name
foreach ($pol in $inlinepols) { Remove-IAMUserPolicy -PolicyName $pol -UserName $name -Force}
# find any managed polices and detach them
$managedpols = Get-IAMAttachedUserPolicies -UserName $name
foreach ($pol in $managedpols) { Unregister-IAMUserPolicy -PolicyArn $pol.PolicyArn -UserName $name }
# find any signing certificates and delete them
$certs = Get-IAMSigningCertificate -UserName $name
foreach ($cert in $certs) { Remove-IAMSigningCertificate -CertificateId $cert.CertificateId -UserName $name -Force }
# find any access keys and delete them
$keys = Get-IAMAccessKey -UserName $name
foreach ($key in $keys) { Remove-IAMAccessKey -AccessKeyId $key.AccessKeyId -UserName $name -Force }
# delete the user's login profile, if one exists - note: need to use try/catch to suppress not found error
try { $prof = Get-IAMLoginProfile -UserName $name -ea 0 } catch { out-null }
if ($prof) { Remove-IAMLoginProfile -UserName $name -Force }
# find any MFA device, detach it, and if virtual, delete it.
$mfa = Get-IAMMFADevice -UserName $name
if ($mfa) {
Disable-IAMMFADevice -SerialNumber $mfa.SerialNumber -UserName $name
if ($mfa.SerialNumber -like "arn:*") { Remove-IAMVirtualMFADevice -SerialNumber $mfa.SerialNumber }
}
# finally, remove the user
Remove-IAMUser -UserName $name -Force
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the IAM user named `Bob`.**
```
Remove-IAMUser -UserName Bob
```
**Example 2: This example deletes the IAM user named `Theresa` along with any elements that must be deleted first.**
```
$name = "Theresa"
# find any groups and remove user from them
$groups = Get-IAMGroupForUser -UserName $name
foreach ($group in $groups) { Remove-IAMUserFromGroup -GroupName $group.GroupName -UserName $name -Force }
# find any inline policies and delete them
$inlinepols = Get-IAMUserPolicies -UserName $name
foreach ($pol in $inlinepols) { Remove-IAMUserPolicy -PolicyName $pol -UserName $name -Force}
# find any managed polices and detach them
$managedpols = Get-IAMAttachedUserPolicies -UserName $name
foreach ($pol in $managedpols) { Unregister-IAMUserPolicy -PolicyArn $pol.PolicyArn -UserName $name }
# find any signing certificates and delete them
$certs = Get-IAMSigningCertificate -UserName $name
foreach ($cert in $certs) { Remove-IAMSigningCertificate -CertificateId $cert.CertificateId -UserName $name -Force }
# find any access keys and delete them
$keys = Get-IAMAccessKey -UserName $name
foreach ($key in $keys) { Remove-IAMAccessKey -AccessKeyId $key.AccessKeyId -UserName $name -Force }
# delete the user's login profile, if one exists - note: need to use try/catch to suppress not found error
try { $prof = Get-IAMLoginProfile -UserName $name -ea 0 } catch { out-null }
if ($prof) { Remove-IAMLoginProfile -UserName $name -Force }
# find any MFA device, detach it, and if virtual, delete it.
$mfa = Get-IAMMFADevice -UserName $name
if ($mfa) {
Disable-IAMMFADevice -SerialNumber $mfa.SerialNumber -UserName $name
if ($mfa.SerialNumber -like "arn:*") { Remove-IAMVirtualMFADevice -SerialNumber $mfa.SerialNumber }
}
# finally, remove the user
Remove-IAMUser -UserName $name -Force
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def delete_user(user_name):
"""
Deletes a user. Before a user can be deleted, all associated resources,
such as access keys and policies, must be deleted or detached.
:param user_name: The name of the user.
"""
try:
iam.User(user_name).delete()
logger.info("Deleted user %s.", user_name)
except ClientError:
logger.exception("Couldn't delete user %s.", user_name)
raise
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DeleteUser) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Deletes a user and their associated resources
#
# @param user_name [String] The name of the user to delete
def delete_user(user_name)
user = @iam_client.list_access_keys(user_name: user_name).access_key_metadata
user.each do |key|
@iam_client.delete_access_key({ access_key_id: key.access_key_id, user_name: user_name })
@logger.info("Deleted access key #{key.access_key_id} for user '#{user_name}'.")
end
@iam_client.delete_user(user_name: user_name)
@logger.info("Deleted user '#{user_name}'.")
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting user '#{user_name}': #{e.message}")
end
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteUser) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_user(client: &iamClient, user: &User) -> Result<(), SdkError> {
let user = user.clone();
let mut tries: i32 = 0;
let max_tries: i32 = 10;
let response: Result<(), SdkError> = loop {
match client
.delete_user()
.user_name(user.user_name())
.send()
.await
{
Ok(_) => {
break Ok(());
}
Err(e) => {
tries += 1;
if tries > max_tries {
break Err(e);
}
sleep(Duration::from_secs(2)).await;
}
}
};
response
}
```
+ For API details, see [DeleteUser](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_user) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->deleteuser( iv_username = iv_user_name ).
MESSAGE 'User deleted successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamdeleteconflictex.
MESSAGE 'User cannot be deleted due to attached resources.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DeleteUser](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func deleteUser(user: IAMClientTypes.User) async throws {
let input = DeleteUserInput(
userName: user.userName
)
do {
_ = try await iamClient.deleteUser(input: input)
} catch {
print("ERROR: deleteUser:", dump(error))
throw error
}
}
```
+ For API details, see [DeleteUser](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/deleteuser(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DeleteUserPermissionsBoundary` with a CLI
The following code examples show how to use `DeleteUserPermissionsBoundary`.
------
#### [ CLI ]
**AWS CLI**
**To delete a permissions boundary from an IAM user**
The following `delete-user-permissions-boundary` example deletes the permissions boundary attached to the IAM user named `intern`. To apply a permissions boundary to a user, use the `put-user-permissions-boundary` command.
```
aws iam delete-user-permissions-boundary \
--user-name intern
```
This command produces no output.
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteUserPermissionsBoundary](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-user-permissions-boundary.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example shows how to remove the permission boundary attached to an IAM user.**
```
Remove-IAMUserPermissionsBoundary -UserName joe
```
+ For API details, see [DeleteUserPermissionsBoundary](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example shows how to remove the permission boundary attached to an IAM user.**
```
Remove-IAMUserPermissionsBoundary -UserName joe
```
+ For API details, see [DeleteUserPermissionsBoundary](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DeleteUserPolicy` with an AWS SDK or CLI
The following code examples show how to use `DeleteUserPolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Delete an IAM user policy.
///
/// The name of the IAM policy to delete.
/// The username of the IAM user.
/// A Boolean value indicating the success of the action.
public async Task DeleteUserPolicyAsync(string policyName, string userName)
{
var response = await _IAMService.DeleteUserPolicyAsync(new DeleteUserPolicyRequest { PolicyName = policyName, UserName = userName });
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DeleteUserPolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DeleteUserPolicy) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To remove a policy from an IAM user**
The following `delete-user-policy` command removes the specified policy from the IAM user named `Bob`.
```
aws iam delete-user-policy \
--user-name Bob \
--policy-name ExamplePolicy
```
This command produces no output.
To get a list of policies for an IAM user, use the `list-user-policies` command.
For more information, see [Creating an IAM user in your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteUserPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-user-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// DeleteUserPolicy deletes an inline policy from a user.
func (wrapper UserWrapper) DeleteUserPolicy(ctx context.Context, userName string, policyName string) error {
_, err := wrapper.IamClient.DeleteUserPolicy(ctx, &iam.DeleteUserPolicyInput{
PolicyName: aws.String(policyName),
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't delete policy from user %v. Here's why: %v\n", userName, err)
}
return err
}
```
+ For API details, see [DeleteUserPolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DeleteUserPolicy) in *AWS SDK for Go API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the inline policy named `AccessToEC2Policy` that is embedded in the IAM user named `Bob`.**
```
Remove-IAMUserPolicy -PolicyName AccessToEC2Policy -UserName Bob
```
**Example 2: This example finds all of the inline polices that are embedded in the IAM user named `Theresa` and then deletes them.**
```
$inlinepols = Get-IAMUserPolicies -UserName Theresa
foreach ($pol in $inlinepols) { Remove-IAMUserPolicy -PolicyName $pol -UserName Theresa -Force}
```
+ For API details, see [DeleteUserPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the inline policy named `AccessToEC2Policy` that is embedded in the IAM user named `Bob`.**
```
Remove-IAMUserPolicy -PolicyName AccessToEC2Policy -UserName Bob
```
**Example 2: This example finds all of the inline polices that are embedded in the IAM user named `Theresa` and then deletes them.**
```
$inlinepols = Get-IAMUserPolicies -UserName Theresa
foreach ($pol in $inlinepols) { Remove-IAMUserPolicy -PolicyName $pol -UserName Theresa -Force}
```
+ For API details, see [DeleteUserPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Deletes a user and their associated resources
#
# @param user_name [String] The name of the user to delete
def delete_user(user_name)
user = @iam_client.list_access_keys(user_name: user_name).access_key_metadata
user.each do |key|
@iam_client.delete_access_key({ access_key_id: key.access_key_id, user_name: user_name })
@logger.info("Deleted access key #{key.access_key_id} for user '#{user_name}'.")
end
@iam_client.delete_user(user_name: user_name)
@logger.info("Deleted user '#{user_name}'.")
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting user '#{user_name}': #{e.message}")
end
```
+ For API details, see [DeleteUserPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DeleteUserPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn delete_user_policy(
client: &iamClient,
user: &User,
policy_name: &str,
) -> Result<(), SdkError> {
client
.delete_user_policy()
.user_name(user.user_name())
.policy_name(policy_name)
.send()
.await?;
Ok(())
}
```
+ For API details, see [DeleteUserPolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.delete_user_policy) in *AWS SDK for Rust API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
func deleteUserPolicy(user: IAMClientTypes.User, policyName: String) async throws {
let input = DeleteUserPolicyInput(
policyName: policyName,
userName: user.userName
)
do {
_ = try await iamClient.deleteUserPolicy(input: input)
} catch {
print("ERROR: deleteUserPolicy:", dump(error))
throw error
}
}
```
+ For API details, see [DeleteUserPolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/deleteuserpolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DeleteVirtualMfaDevice` with a CLI
The following code examples show how to use `DeleteVirtualMfaDevice`.
------
#### [ CLI ]
**AWS CLI**
**To remove a virtual MFA device**
The following `delete-virtual-mfa-device` command removes the specified MFA device from the current account.
```
aws iam delete-virtual-mfa-device \
--serial-number arn:aws:iam::123456789012:mfa/MFATest
```
This command produces no output.
For more information, see [Deactivating MFA devices](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_disable.html) in the *AWS IAM User Guide*.
+ For API details, see [DeleteVirtualMfaDevice](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-virtual-mfa-device.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the IAM virtual MFA device whose ARN is `arn:aws:iam::123456789012:mfa/bob`.**
```
Remove-IAMVirtualMFADevice -SerialNumber arn:aws:iam::123456789012:mfa/bob
```
**Example 2: This example checks to see whether the IAM user Theresa has an MFA device assigned. If one is found, the device is disabled for the IAM user. If the device is virtual, then it is also deleted.**
```
$mfa = Get-IAMMFADevice -UserName Theresa
if ($mfa) {
Disable-IAMMFADevice -SerialNumber $mfa.SerialNumber -UserName $name
if ($mfa.SerialNumber -like "arn:*") { Remove-IAMVirtualMFADevice -SerialNumber $mfa.SerialNumber }
}
```
+ For API details, see [DeleteVirtualMfaDevice](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the IAM virtual MFA device whose ARN is `arn:aws:iam::123456789012:mfa/bob`.**
```
Remove-IAMVirtualMFADevice -SerialNumber arn:aws:iam::123456789012:mfa/bob
```
**Example 2: This example checks to see whether the IAM user Theresa has an MFA device assigned. If one is found, the device is disabled for the IAM user. If the device is virtual, then it is also deleted.**
```
$mfa = Get-IAMMFADevice -UserName Theresa
if ($mfa) {
Disable-IAMMFADevice -SerialNumber $mfa.SerialNumber -UserName $name
if ($mfa.SerialNumber -like "arn:*") { Remove-IAMVirtualMFADevice -SerialNumber $mfa.SerialNumber }
}
```
+ For API details, see [DeleteVirtualMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DetachGroupPolicy` with a CLI
The following code examples show how to use `DetachGroupPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To detach a policy from a group**
This example removes the managed policy with the ARN `arn:aws:iam::123456789012:policy/TesterAccessPolicy` from the group called `Testers`.
```
aws iam detach-group-policy \
--group-name Testers \
--policy-arn arn:aws:iam::123456789012:policy/TesterAccessPolicy
```
This command produces no output.
For more information, see [Managing IAM user groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [DetachGroupPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-group-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example detaches the managed group policy whose ARN is `arn:aws:iam::123456789012:policy/TesterAccessPolicy` from the group named `Testers`.**
```
Unregister-IAMGroupPolicy -GroupName Testers -PolicyArn arn:aws:iam::123456789012:policy/TesterAccessPolicy
```
**Example 2: This example finds all the managed policies that are attached to the group named `Testers` and detaches them from the group.**
```
Get-IAMAttachedGroupPolicies -GroupName Testers | Unregister-IAMGroupPolicy -Groupname Testers
```
+ For API details, see [DetachGroupPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example detaches the managed group policy whose ARN is `arn:aws:iam::123456789012:policy/TesterAccessPolicy` from the group named `Testers`.**
```
Unregister-IAMGroupPolicy -GroupName Testers -PolicyArn arn:aws:iam::123456789012:policy/TesterAccessPolicy
```
**Example 2: This example finds all the managed policies that are attached to the group named `Testers` and detaches them from the group.**
```
Get-IAMAttachedGroupPolicies -GroupName Testers | Unregister-IAMGroupPolicy -Groupname Testers
```
+ For API details, see [DetachGroupPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `DetachRolePolicy` with an AWS SDK or CLI
The following code examples show how to use `DetachRolePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Configure Amazon ECS Service Connect](iam_example_ecs_ServiceConnect_085_section.md)
+ [Create a REST API with Lambda proxy integration](iam_example_api_gateway_GettingStarted_087_section.md)
+ [Creating a CloudWatch dashboard with function name as a variable](iam_example_cloudwatch_GettingStarted_031_section.md)
+ [Creating an Amazon Managed Grafana workspace](iam_example_iam_GettingStarted_044_section.md)
+ [Creating your first Lambda function](iam_example_lambda_GettingStarted_019_section.md)
+ [Getting started with Amazon EKS](iam_example_eks_GettingStarted_034_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Amazon SageMaker Feature Store](iam_example_iam_GettingStarted_028_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Getting started with Step Functions](iam_example_iam_GettingStarted_080_section.md)
+ [Manage roles](iam_example_iam_Scenario_RoleManagement_section.md)
+ [Moving hardcoded secrets to Secrets Manager](iam_example_secrets_manager_GettingStarted_073_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
+ [Setting up Systems Manager](iam_example_iam_GettingStarted_046_section.md)
+ [Using property variables in CloudWatch dashboards to monitor multiple Lambda functions](iam_example_iam_GettingStarted_032_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Detach an IAM policy from an IAM role.
///
/// The Amazon Resource Name (ARN) of the IAM policy.
/// The name of the IAM role.
/// A Boolean value indicating the success of the action.
public async Task DetachRolePolicyAsync(string policyArn, string roleName)
{
var response = await _IAMService.DetachRolePolicyAsync(new DetachRolePolicyRequest
{
PolicyArn = policyArn,
RoleName = roleName,
});
return response.HttpStatusCode == System.Net.HttpStatusCode.OK;
}
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_detach_role_policy
#
# This function detaches an IAM policy to a tole.
#
# Parameters:
# -n role_name -- The name of the IAM role.
# -p policy_ARN -- The IAM policy document ARN..
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_detach_role_policy() {
local role_name policy_arn response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_detach_role_policy"
echo "Detaches an AWS Identity and Access Management (IAM) policy to an IAM role."
echo " -n role_name The name of the IAM role."
echo " -p policy_ARN -- The IAM policy document ARN."
echo ""
}
# Retrieve the calling parameters.
while getopts "n:p:h" option; do
case "${option}" in
n) role_name="${OPTARG}" ;;
p) policy_arn="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$role_name" ]]; then
errecho "ERROR: You must provide a role name with the -n parameter."
usage
return 1
fi
if [[ -z "$policy_arn" ]]; then
errecho "ERROR: You must provide a policy ARN with the -p parameter."
usage
return 1
fi
response=$(aws iam detach-role-policy \
--role-name "$role_name" \
--policy-arn "$policy_arn")
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports detach-role-policy operation failed.\n$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/DetachRolePolicy) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::DetachRolePolicyRequest detachRequest;
detachRequest.SetRoleName(roleName);
detachRequest.SetPolicyArn(policyArn);
auto detachOutcome = iam.DetachRolePolicy(detachRequest);
if (!detachOutcome.IsSuccess()) {
std::cerr << "Failed to detach policy " << policyArn << " from role "
<< roleName << ": " << detachOutcome.GetError().GetMessage() <<
std::endl;
}
else {
std::cout << "Successfully detached policy " << policyArn << " from role "
<< roleName << std::endl;
}
return detachOutcome.IsSuccess();
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To detach a policy from a role**
This example removes the managed policy with the ARN `arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy` from the role called `FedTesterRole`.
```
aws iam detach-role-policy \
--role-name FedTesterRole \
--policy-arn arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy
```
This command produces no output.
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [DetachRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// DetachRolePolicy detaches a policy from a role.
func (wrapper RoleWrapper) DetachRolePolicy(ctx context.Context, roleName string, policyArn string) error {
_, err := wrapper.IamClient.DetachRolePolicy(ctx, &iam.DetachRolePolicyInput{
PolicyArn: aws.String(policyArn),
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't detach policy from role %v. Here's why: %v\n", roleName, err)
}
return err
}
```
+ For API details, see [DetachRolePolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.DetachRolePolicy) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.DetachRolePolicyRequest;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class DetachRolePolicy {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
roleName - A role name that you can obtain from the AWS Management Console.\s
policyArn - A policy ARN that you can obtain from the AWS Management Console.\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String roleName = args[0];
String policyArn = args[1];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
detachPolicy(iam, roleName, policyArn);
System.out.println("Done");
iam.close();
}
public static void detachPolicy(IamClient iam, String roleName, String policyArn) {
try {
DetachRolePolicyRequest request = DetachRolePolicyRequest.builder()
.roleName(roleName)
.policyArn(policyArn)
.build();
iam.detachRolePolicy(request);
System.out.println("Successfully detached policy " + policyArn +
" from role " + roleName);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Detach the policy.
```
import { DetachRolePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} policyArn
* @param {string} roleName
*/
export const detachRolePolicy = (policyArn, roleName) => {
const command = new DetachRolePolicyCommand({
PolicyArn: policyArn,
RoleName: roleName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-policies.html#iam-examples-policies-detaching-role-policy).
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/DetachRolePolicyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var paramsRoleList = {
RoleName: process.argv[2],
};
iam.listAttachedRolePolicies(paramsRoleList, function (err, data) {
if (err) {
console.log("Error", err);
} else {
var myRolePolicies = data.AttachedPolicies;
myRolePolicies.forEach(function (val, index, array) {
if (myRolePolicies[index].PolicyName === "AmazonDynamoDBFullAccess") {
var params = {
PolicyArn: "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess",
RoleName: process.argv[2],
};
iam.detachRolePolicy(params, function (err, data) {
if (err) {
console.log("Unable to detach policy from role", err);
} else {
console.log("Policy detached from role successfully");
process.exit();
}
});
}
});
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-policies.html#iam-examples-policies-detaching-role-policy).
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun detachPolicy(
roleNameVal: String,
policyArnVal: String,
) {
val request =
DetachRolePolicyRequest {
roleName = roleNameVal
policyArn = policyArnVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.detachRolePolicy(request)
println("Successfully detached policy $policyArnVal from role $roleNameVal")
}
}
```
+ For API details, see [DetachRolePolicy](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example detaches the managed group policy whose ARN is `arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy` from the role named `FedTesterRole`.**
```
Unregister-IAMRolePolicy -RoleName FedTesterRole -PolicyArn arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy
```
**Example 2: This example finds all of the managed policies that are attached to the role named `FedTesterRole` and detaches them from the role.**
```
Get-IAMAttachedRolePolicyList -RoleName FedTesterRole | Unregister-IAMRolePolicy -Rolename FedTesterRole
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example detaches the managed group policy whose ARN is `arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy` from the role named `FedTesterRole`.**
```
Unregister-IAMRolePolicy -RoleName FedTesterRole -PolicyArn arn:aws:iam::123456789012:policy/FederatedTesterAccessPolicy
```
**Example 2: This example finds all of the managed policies that are attached to the role named `FedTesterRole` and detaches them from the role.**
```
Get-IAMAttachedRolePolicyList -RoleName FedTesterRole | Unregister-IAMRolePolicy -Rolename FedTesterRole
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
Detach a policy from a role using the Boto3 Policy object.
```
def detach_from_role(role_name, policy_arn):
"""
Detaches a policy from a role.
:param role_name: The name of the role. **Note** this is the name, not the ARN.
:param policy_arn: The ARN of the policy.
"""
try:
iam.Policy(policy_arn).detach_role(RoleName=role_name)
logger.info("Detached policy %s from role %s.", policy_arn, role_name)
except ClientError:
logger.exception(
"Couldn't detach policy %s from role %s.", policy_arn, role_name
)
raise
```
Detach a policy from a role using the Boto3 Role object.
```
def detach_policy(role_name, policy_arn):
"""
Detaches a policy from a role.
:param role_name: The name of the role. **Note** this is the name, not the ARN.
:param policy_arn: The ARN of the policy.
"""
try:
iam.Role(role_name).detach_policy(PolicyArn=policy_arn)
logger.info("Detached policy %s from role %s.", policy_arn, role_name)
except ClientError:
logger.exception(
"Couldn't detach policy %s from role %s.", policy_arn, role_name
)
raise
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, attaches, and detaches role policies.
```
# Manages policies in AWS Identity and Access Management (IAM)
class RolePolicyManager
# Initialize with an AWS IAM client
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'PolicyManager'
end
# Creates a policy
#
# @param policy_name [String] The name of the policy
# @param policy_document [Hash] The policy document
# @return [String] The policy ARN if successful, otherwise nil
def create_policy(policy_name, policy_document)
response = @iam_client.create_policy(
policy_name: policy_name,
policy_document: policy_document.to_json
)
response.policy.arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating policy: #{e.message}")
nil
end
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
# Attaches a policy to a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_role(role_name, policy_arn)
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to role: #{e.message}")
false
end
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
# Detaches a policy from a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def detach_policy_from_role(role_name, policy_arn)
@iam_client.detach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from role: #{e.message}")
false
end
end
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DetachRolePolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn detach_role_policy(
client: &iamClient,
role_name: &str,
policy_arn: &str,
) -> Result<(), iamError> {
client
.detach_role_policy()
.role_name(role_name)
.policy_arn(policy_arn)
.send()
.await?;
Ok(())
}
```
+ For API details, see [DetachRolePolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.detach_role_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->detachrolepolicy(
iv_rolename = iv_role_name
iv_policyarn = iv_policy_arn ).
MESSAGE 'Policy detached from role successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role or policy does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DetachRolePolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func detachRolePolicy(policy: IAMClientTypes.Policy, role: IAMClientTypes.Role) async throws {
let input = DetachRolePolicyInput(
policyArn: policy.arn,
roleName: role.roleName
)
do {
_ = try await iamClient.detachRolePolicy(input: input)
} catch {
print("ERROR: detachRolePolicy:", dump(error))
throw error
}
}
```
+ For API details, see [DetachRolePolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/detachrolepolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `DetachUserPolicy` with an AWS SDK or CLI
The following code examples show how to use `DetachUserPolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ CLI ]
**AWS CLI**
**To detach a policy from a user**
This example removes the managed policy with the ARN `arn:aws:iam::123456789012:policy/TesterPolicy` from the user `Bob`.
```
aws iam detach-user-policy \
--user-name Bob \
--policy-arn arn:aws:iam::123456789012:policy/TesterPolicy
```
This command produces no output.
For more information, see [Changing permissions for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html) in the *AWS IAM User Guide*.
+ For API details, see [DetachUserPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/detach-user-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example detaches the managed policy whose ARN is `arn:aws:iam::123456789012:policy/TesterPolicy` from the IAM user named `Bob`.**
```
Unregister-IAMUserPolicy -UserName Bob -PolicyArn arn:aws:iam::123456789012:policy/TesterPolicy
```
**Example 2: This example finds all the managed policies that are attached to the IAM user named `Theresa` and detaches those policies from the user.**
```
Get-IAMAttachedUserPolicyList -UserName Theresa | Unregister-IAMUserPolicy -Username Theresa
```
+ For API details, see [DetachUserPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example detaches the managed policy whose ARN is `arn:aws:iam::123456789012:policy/TesterPolicy` from the IAM user named `Bob`.**
```
Unregister-IAMUserPolicy -UserName Bob -PolicyArn arn:aws:iam::123456789012:policy/TesterPolicy
```
**Example 2: This example finds all the managed policies that are attached to the IAM user named `Theresa` and detaches those policies from the user.**
```
Get-IAMAttachedUserPolicyList -UserName Theresa | Unregister-IAMUserPolicy -Username Theresa
```
+ For API details, see [DetachUserPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def detach_policy(user_name, policy_arn):
"""
Detaches a policy from a user.
:param user_name: The name of the user.
:param policy_arn: The Amazon Resource Name (ARN) of the policy.
"""
try:
iam.User(user_name).detach_policy(PolicyArn=policy_arn)
logger.info("Detached policy %s from user %s.", policy_arn, user_name)
except ClientError:
logger.exception(
"Couldn't detach policy %s from user %s.", policy_arn, user_name
)
raise
```
+ For API details, see [DetachUserPolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/DetachUserPolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Detaches a policy from a user
#
# @param user_name [String] The name of the user
# @param policy_arn [String] The ARN of the policy to detach
# @return [Boolean] true if the policy was successfully detached, false otherwise
def detach_user_policy(user_name, policy_arn)
@iam_client.detach_user_policy(
user_name: user_name,
policy_arn: policy_arn
)
@logger.info("Policy '#{policy_arn}' detached from user '#{user_name}' successfully.")
true
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error('Error detaching policy: Policy or user does not exist.')
false
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from user '#{user_name}': #{e.message}")
false
end
```
+ For API details, see [DetachUserPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/DetachUserPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn detach_user_policy(
client: &iamClient,
user_name: &str,
policy_arn: &str,
) -> Result<(), iamError> {
client
.detach_user_policy()
.user_name(user_name)
.policy_arn(policy_arn)
.send()
.await?;
Ok(())
}
```
+ For API details, see [DetachUserPolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.detach_user_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->detachuserpolicy(
iv_username = iv_user_name
iv_policyarn = iv_policy_arn ).
MESSAGE 'Policy detached from user successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User or policy does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [DetachUserPolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `EnableMfaDevice` with a CLI
The following code examples show how to use `EnableMfaDevice`.
------
#### [ CLI ]
**AWS CLI**
**To enable an MFA device**
After you use the `create-virtual-mfa-device` command to create a new virtual MFA device, you can assign the MFA device to a user. The following `enable-mfa-device` example assigns the MFA device with the serial number `arn:aws:iam::210987654321:mfa/BobsMFADevice` to the user `Bob`. The command also synchronizes the device with AWS by including the first two codes in sequence from the virtual MFA device.
```
aws iam enable-mfa-device \
--user-name Bob \
--serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice \
--authentication-code1 123456 \
--authentication-code2 789012
```
This command produces no output.
For more information, see [Enabling a virtual multi-factor authentication (MFA) device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html) in the *AWS IAM User Guide*.
+ For API details, see [EnableMfaDevice](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/enable-mfa-device.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command enables the hardware MFA device with the serial number `987654321098` and associates the device with the user `Bob`. It includes the first two codes in sequence from the device.**
```
Enable-IAMMFADevice -UserName "Bob" -SerialNumber "987654321098" -AuthenticationCode1 "12345678" -AuthenticationCode2 "87654321"
```
**Example 2: This example creates and enables a virtual MFA device. The first command creates the virtual device and returns the device's object representation in the variable `$MFADevice`. You can use the `.Base32StringSeed` or `QRCodePng` properties to configure the user's software application. The final command assigns the device to the user `David`, identifying the device by its serial number. The command also synchronizes the device with AWS by including the first two codes in sequence from the virtual MFA device.**
```
$MFADevice = New-IAMVirtualMFADevice -VirtualMFADeviceName "MyMFADevice"
# see example for New-IAMVirtualMFADevice to see how to configure the software program with PNG or base32 seed code
Enable-IAMMFADevice -UserName "David" -SerialNumber -SerialNumber $MFADevice.SerialNumber -AuthenticationCode1 "24681357" -AuthenticationCode2 "13572468"
```
+ For API details, see [EnableMfaDevice](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command enables the hardware MFA device with the serial number `987654321098` and associates the device with the user `Bob`. It includes the first two codes in sequence from the device.**
```
Enable-IAMMFADevice -UserName "Bob" -SerialNumber "987654321098" -AuthenticationCode1 "12345678" -AuthenticationCode2 "87654321"
```
**Example 2: This example creates and enables a virtual MFA device. The first command creates the virtual device and returns the device's object representation in the variable `$MFADevice`. You can use the `.Base32StringSeed` or `QRCodePng` properties to configure the user's software application. The final command assigns the device to the user `David`, identifying the device by its serial number. The command also synchronizes the device with AWS by including the first two codes in sequence from the virtual MFA device.**
```
$MFADevice = New-IAMVirtualMFADevice -VirtualMFADeviceName "MyMFADevice"
# see example for New-IAMVirtualMFADevice to see how to configure the software program with PNG or base32 seed code
Enable-IAMMFADevice -UserName "David" -SerialNumber -SerialNumber $MFADevice.SerialNumber -AuthenticationCode1 "24681357" -AuthenticationCode2 "13572468"
```
+ For API details, see [EnableMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GenerateCredentialReport` with an AWS SDK or CLI
The following code examples show how to use `GenerateCredentialReport`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ CLI ]
**AWS CLI**
**To generate a credential report**
The following example attempts to generate a credential report for the AWS account.
```
aws iam generate-credential-report
```
Output:
```
{
"State": "STARTED",
"Description": "No report exists. Starting a new report generation task"
}
```
For more information, see [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) in the *AWS IAM User Guide*.
+ For API details, see [GenerateCredentialReport](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/generate-credential-report.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example requests generation of a new report, which can be done every four hours. If the last report is still recent the State field reads `COMPLETE`. Use `Get-IAMCredentialReport` to view the completed report.**
```
Request-IAMCredentialReport
```
**Output:**
```
Description State
----------- -----
No report exists. Starting a new report generation task STARTED
```
+ For API details, see [GenerateCredentialReport](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example requests generation of a new report, which can be done every four hours. If the last report is still recent the State field reads `COMPLETE`. Use `Get-IAMCredentialReport` to view the completed report.**
```
Request-IAMCredentialReport
```
**Output:**
```
Description State
----------- -----
No report exists. Starting a new report generation task STARTED
```
+ For API details, see [GenerateCredentialReport](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def generate_credential_report():
"""
Starts generation of a credentials report about the current account. After
calling this function to generate the report, call get_credential_report
to get the latest report. A new report can be generated a minimum of four hours
after the last one was generated.
"""
try:
response = iam.meta.client.generate_credential_report()
logger.info(
"Generating credentials report for your account. " "Current state is %s.",
response["State"],
)
except ClientError:
logger.exception("Couldn't generate a credentials report for your account.")
raise
else:
return response
```
+ For API details, see [GenerateCredentialReport](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GenerateCredentialReport) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->generatecredentialreport( ).
MESSAGE 'Credential report generation started.' TYPE 'I'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Report generation limit exceeded.' TYPE 'E'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when generating credential report.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GenerateCredentialReport](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GenerateServiceLastAccessedDetails` with a CLI
The following code examples show how to use `GenerateServiceLastAccessedDetails`.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To generate a service access report for a custom policy**
The following `generate-service-last-accessed-details` example starts a background job to generate a report that lists the services accessed by IAM users and other entities with a custom policy named `intern-boundary`. You can display the report after it is created by running the `get-service-last-accessed-details` command.
```
aws iam generate-service-last-accessed-details \
--arn arn:aws:iam::123456789012:policy/intern-boundary
```
Output:
```
{
"JobId": "2eb6c2b8-7b4c-3xmp-3c13-03b72c8cdfdc"
}
```
**Example 2: To generate a service access report for the AWS managed AdministratorAccess policy**
The following `generate-service-last-accessed-details` example starts a background job to generate a report that lists the services accessed by IAM users and other entities with the AWS managed `AdministratorAccess` policy. You can display the report after it is created by running the `get-service-last-accessed-details` command.
```
aws iam generate-service-last-accessed-details \
--arn arn:aws:iam::aws:policy/AdministratorAccess
```
Output:
```
{
"JobId": "78b6c2ba-d09e-6xmp-7039-ecde30b26916"
}
```
For more information, see [Refining permissions in AWS using last accessed information](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html) in the *AWS IAM User Guide*.
+ For API details, see [GenerateServiceLastAccessedDetails](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/generate-service-last-accessed-details.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example is equivalent cmdlet of GenerateServiceLastAccessedDetails API. This provides with a job id which can be used in Get-IAMServiceLastAccessedDetail and Get-IAMServiceLastAccessedDetailWithEntity**
```
Request-IAMServiceLastAccessedDetail -Arn arn:aws:iam::123456789012:user/TestUser
```
+ For API details, see [GenerateServiceLastAccessedDetails](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example is equivalent cmdlet of GenerateServiceLastAccessedDetails API. This provides with a job id which can be used in Get-IAMServiceLastAccessedDetail and Get-IAMServiceLastAccessedDetailWithEntity**
```
Request-IAMServiceLastAccessedDetail -Arn arn:aws:iam::123456789012:user/TestUser
```
+ For API details, see [GenerateServiceLastAccessedDetails](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetAccessKeyLastUsed` with an AWS SDK or CLI
The following code examples show how to use `GetAccessKeyLastUsed`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::accessKeyLastUsed(const Aws::String &secretKeyID,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::GetAccessKeyLastUsedRequest request;
request.SetAccessKeyId(secretKeyID);
Aws::IAM::Model::GetAccessKeyLastUsedOutcome outcome = iam.GetAccessKeyLastUsed(
request);
if (!outcome.IsSuccess()) {
std::cerr << "Error querying last used time for access key " <<
secretKeyID << ":" << outcome.GetError().GetMessage() << std::endl;
}
else {
Aws::String lastUsedTimeString =
outcome.GetResult()
.GetAccessKeyLastUsed()
.GetLastUsedDate()
.ToGmtString(Aws::Utils::DateFormat::ISO_8601);
std::cout << "Access key " << secretKeyID << " last used at time " <<
lastUsedTimeString << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/GetAccessKeyLastUsed) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To retrieve information about when the specified access key was last used**
The following example retrieves information about when the access key `ABCDEXAMPLE` was last used.
```
aws iam get-access-key-last-used \
--access-key-id ABCDEXAMPLE
```
Output:
```
{
"UserName": "Bob",
"AccessKeyLastUsed": {
"Region": "us-east-1",
"ServiceName": "iam",
"LastUsedDate": "2015-06-16T22:45:00Z"
}
}
```
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *AWS IAM User Guide*.
+ For API details, see [GetAccessKeyLastUsed](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-access-key-last-used.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Get the access key.
```
import { GetAccessKeyLastUsedCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} accessKeyId
*/
export const getAccessKeyLastUsed = async (accessKeyId) => {
const command = new GetAccessKeyLastUsedCommand({
AccessKeyId: accessKeyId,
});
const response = await client.send(command);
if (response.AccessKeyLastUsed?.LastUsedDate) {
console.log(`
${accessKeyId} was last used by ${response.UserName} via
the ${response.AccessKeyLastUsed.ServiceName} service on
${response.AccessKeyLastUsed.LastUsedDate.toISOString()}
`);
}
return response;
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-last-used).
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetAccessKeyLastUsedCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.getAccessKeyLastUsed(
{ AccessKeyId: "ACCESS_KEY_ID" },
function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data.AccessKeyLastUsed);
}
}
);
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-last-used).
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/GetAccessKeyLastUsed) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: Returns the owning user name and last-usage information for the supplied access key.**
```
Get-IAMAccessKeyLastUsed -AccessKeyId ABCDEXAMPLE
```
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: Returns the owning user name and last-usage information for the supplied access key.**
```
Get-IAMAccessKeyLastUsed -AccessKeyId ABCDEXAMPLE
```
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_last_use(key_id):
"""
Gets information about when and how a key was last used.
:param key_id: The ID of the key to look up.
:return: Information about the key's last use.
"""
try:
response = iam.meta.client.get_access_key_last_used(AccessKeyId=key_id)
last_used_date = response["AccessKeyLastUsed"].get("LastUsedDate", None)
last_service = response["AccessKeyLastUsed"].get("ServiceName", None)
logger.info(
"Key %s was last used by %s on %s to access %s.",
key_id,
response["UserName"],
last_used_date,
last_service,
)
except ClientError:
logger.exception("Couldn't get last use of key %s.", key_id)
raise
else:
return response
```
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetAccessKeyLastUsed) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getaccesskeylastused(
iv_accesskeyid = iv_access_key_id ).
MESSAGE 'Retrieved access key last used information.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Access key does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetAccessKeyLastUsed](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetAccountAuthorizationDetails` with an AWS SDK or CLI
The following code examples show how to use `GetAccountAuthorizationDetails`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ CLI ]
**AWS CLI**
**To list an AWS account's IAM users, groups, roles, and policies**
The following `get-account-authorization-details` command returns information about all IAM users, groups, roles, and policies in the AWS account.
```
aws iam get-account-authorization-details
```
Output:
```
{
"RoleDetailList": [
{
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"RoleId": "AROA1234567890EXAMPLE",
"CreateDate": "2014-07-30T17:09:20Z",
"InstanceProfileList": [
{
"InstanceProfileId": "AIPA1234567890EXAMPLE",
"Roles": [
{
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"RoleId": "AROA1234567890EXAMPLE",
"CreateDate": "2014-07-30T17:09:20Z",
"RoleName": "EC2role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/EC2role"
}
],
"CreateDate": "2014-07-30T17:09:20Z",
"InstanceProfileName": "EC2role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/EC2role"
}
],
"RoleName": "EC2role",
"Path": "/",
"AttachedManagedPolicies": [
{
"PolicyName": "AmazonS3FullAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"
},
{
"PolicyName": "AmazonDynamoDBFullAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}
],
"RoleLastUsed": {
"Region": "us-west-2",
"LastUsedDate": "2019-11-13T17:30:00Z"
},
"RolePolicyList": [],
"Arn": "arn:aws:iam::123456789012:role/EC2role"
}
],
"GroupDetailList": [
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": {
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
},
"GroupName": "Admins",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Admins",
"CreateDate": "2013-10-14T18:32:24Z",
"GroupPolicyList": []
},
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": {
"PolicyName": "PowerUserAccess",
"PolicyArn": "arn:aws:iam::aws:policy/PowerUserAccess"
},
"GroupName": "Dev",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Dev",
"CreateDate": "2013-10-14T18:33:55Z",
"GroupPolicyList": []
},
{
"GroupId": "AIDA1234567890EXAMPLE",
"AttachedManagedPolicies": [],
"GroupName": "Finance",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:group/Finance",
"CreateDate": "2013-10-14T18:57:48Z",
"GroupPolicyList": [
{
"PolicyName": "policygen-201310141157",
"PolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Action": "aws-portal:*",
"Sid": "Stmt1381777017000",
"Resource": "*",
"Effect": "Allow"
}
]
}
}
]
}
],
"UserDetailList": [
{
"UserName": "Alice",
"GroupList": [
"Admins"
],
"CreateDate": "2013-10-14T18:32:24Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Alice"
},
{
"UserName": "Bob",
"GroupList": [
"Admins"
],
"CreateDate": "2013-10-14T18:32:25Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [
{
"PolicyName": "DenyBillingAndIAMPolicy",
"PolicyDocument": {
"Version":"2012-10-17",
"Statement": {
"Effect": "Deny",
"Action": [
"aws-portal:*",
"iam:*"
],
"Resource": "*"
}
}
}
],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Bob"
},
{
"UserName": "Charlie",
"GroupList": [
"Dev"
],
"CreateDate": "2013-10-14T18:33:56Z",
"UserId": "AIDA1234567890EXAMPLE",
"UserPolicyList": [],
"Path": "/",
"AttachedManagedPolicies": [],
"Arn": "arn:aws:iam::123456789012:user/Charlie"
}
],
"Policies": [
{
"PolicyName": "create-update-delete-set-managed-policies",
"CreateDate": "2015-02-06T19:58:34Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2015-02-06T19:58:34Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:CreatePolicy",
"iam:CreatePolicyVersion",
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListPolicies",
"iam:ListPolicyVersions",
"iam:SetDefaultPolicyVersion"
],
"Resource": "*"
}
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::123456789012:policy/create-update-delete-set-managed-policies",
"UpdateDate": "2015-02-06T19:58:34Z"
},
{
"PolicyName": "S3-read-only-specific-bucket",
"CreateDate": "2015-01-21T21:39:41Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2015-01-21T21:39:41Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket",
"arn:aws:s3:::amzn-s3-demo-bucket/*"
]
}
]
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::123456789012:policy/S3-read-only-specific-bucket",
"UpdateDate": "2015-01-21T23:39:41Z"
},
{
"PolicyName": "AmazonEC2FullAccess",
"CreateDate": "2015-02-06T18:40:15Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPA1234567890EXAMPLE",
"DefaultVersionId": "v1",
"PolicyVersionList": [
{
"CreateDate": "2014-10-30T20:59:46Z",
"VersionId": "v1",
"Document": {
"Version":"2012-10-17",
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "cloudwatch:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "autoscaling:*",
"Resource": "*"
}
]
},
"IsDefaultVersion": true
}
],
"Path": "/",
"Arn": "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
"UpdateDate": "2015-02-06T18:40:15Z"
}
],
"Marker": "EXAMPLEkakv9BCuUNFDtxWSyfzetYwEx2ADc8dnzfvERF5S6YMvXKx41t6gCl/eeaCX3Jo94/bKqezEAg8TEVS99EKFLxm3jtbpl25FDWEXAMPLE",
"IsTruncated": true
}
```
For more information, see [AWS security audit guidelines](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-audit-guide.html) in the *AWS IAM User Guide*.
+ For API details, see [GetAccountAuthorizationDetails](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-account-authorization-details.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example gets authorization details about the identities in the AWS account, and displays the element list of the returned object, including users, groups, and roles. For example, the `UserDetailList` property displays details about the users. Similar information is available in the `RoleDetailList` and `GroupDetailList` properties.**
```
$Details=Get-IAMAccountAuthorizationDetail
$Details
```
**Output:**
```
GroupDetailList : {Administrators, Developers, Testers, Backup}
IsTruncated : False
Marker :
RoleDetailList : {TestRole1, AdminRole, TesterRole, clirole...}
UserDetailList : {Administrator, Bob, BackupToS3, }
```
```
$Details.UserDetailList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
GroupList : {Administrators}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE1
UserName : Administrator
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
GroupList : {Developers}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE2
UserName : bab
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/BackupToS3
CreateDate : 1/27/2015 10:15:08 AM
GroupList : {Backup}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE3
UserName : BackupToS3
UserPolicyList : {BackupServicePermissionsToS3Buckets}
```
+ For API details, see [GetAccountAuthorizationDetails](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example gets authorization details about the identities in the AWS account, and displays the element list of the returned object, including users, groups, and roles. For example, the `UserDetailList` property displays details about the users. Similar information is available in the `RoleDetailList` and `GroupDetailList` properties.**
```
$Details=Get-IAMAccountAuthorizationDetail
$Details
```
**Output:**
```
GroupDetailList : {Administrators, Developers, Testers, Backup}
IsTruncated : False
Marker :
RoleDetailList : {TestRole1, AdminRole, TesterRole, clirole...}
UserDetailList : {Administrator, Bob, BackupToS3, }
```
```
$Details.UserDetailList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
GroupList : {Administrators}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE1
UserName : Administrator
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
GroupList : {Developers}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE2
UserName : bab
UserPolicyList : {}
Arn : arn:aws:iam::123456789012:user/BackupToS3
CreateDate : 1/27/2015 10:15:08 AM
GroupList : {Backup}
Path : /
UserId : AIDACKCEVSQ6CEXAMPLE3
UserName : BackupToS3
UserPolicyList : {BackupServicePermissionsToS3Buckets}
```
+ For API details, see [GetAccountAuthorizationDetails](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_authorization_details(response_filter):
"""
Gets an authorization detail report for the current account.
:param response_filter: A list of resource types to include in the report, such
as users or roles. When not specified, all resources
are included.
:return: The authorization detail report.
"""
try:
account_details = iam.meta.client.get_account_authorization_details(
Filter=response_filter
)
logger.debug(account_details)
except ClientError:
logger.exception("Couldn't get details for your account.")
raise
else:
return account_details
```
+ For API details, see [GetAccountAuthorizationDetails](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetAccountAuthorizationDetails) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getaccountauthdetails( ).
MESSAGE 'Retrieved account authorization details.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when getting account authorization details.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetAccountAuthorizationDetails](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetAccountPasswordPolicy` with an AWS SDK or CLI
The following code examples show how to use `GetAccountPasswordPolicy`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Gets the IAM password policy for an AWS account.
///
/// The PasswordPolicy for the AWS account.
public async Task GetAccountPasswordPolicyAsync()
{
var response = await _IAMService.GetAccountPasswordPolicyAsync(new GetAccountPasswordPolicyRequest());
return response.PasswordPolicy;
}
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/GetAccountPasswordPolicy) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To see the current account password policy**
The following `get-account-password-policy` command displays details about the password policy for the current account.
```
aws iam get-account-password-policy
```
Output:
```
{
"PasswordPolicy": {
"AllowUsersToChangePassword": false,
"RequireLowercaseCharacters": false,
"RequireUppercaseCharacters": false,
"MinimumPasswordLength": 8,
"RequireNumbers": true,
"RequireSymbols": true
}
}
```
If no password policy is defined for the account, the command returns a `NoSuchEntity` error.
For more information, see [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) in the *AWS IAM User Guide*.
+ For API details, see [GetAccountPasswordPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-account-password-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"log"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// AccountWrapper encapsulates AWS Identity and Access Management (IAM) account actions
// used in the examples.
// It contains an IAM service client that is used to perform account actions.
type AccountWrapper struct {
IamClient *iam.Client
}
// GetAccountPasswordPolicy gets the account password policy for the current account.
// If no policy has been set, a NoSuchEntityException is error is returned.
func (wrapper AccountWrapper) GetAccountPasswordPolicy(ctx context.Context) (*types.PasswordPolicy, error) {
var pwPolicy *types.PasswordPolicy
result, err := wrapper.IamClient.GetAccountPasswordPolicy(ctx,
&iam.GetAccountPasswordPolicyInput{})
if err != nil {
log.Printf("Couldn't get account password policy. Here's why: %v\n", err)
} else {
pwPolicy = result.PasswordPolicy
}
return pwPolicy, err
}
```
+ For API details, see [GetAccountPasswordPolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.GetAccountPasswordPolicy) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Get the account password policy.
```
import {
GetAccountPasswordPolicyCommand,
IAMClient,
} from "@aws-sdk/client-iam";
const client = new IAMClient({});
export const getAccountPasswordPolicy = async () => {
const command = new GetAccountPasswordPolicyCommand({});
const response = await client.send(command);
console.log(response.PasswordPolicy);
return response;
};
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetAccountPasswordPolicyCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function getAccountPasswordPolicy()
{
return $this->iamClient->getAccountPasswordPolicy();
}
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/GetAccountPasswordPolicy) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the password policy for the current account. If no password policy is defined for the account, the command returns a `NoSuchEntity` error.**
```
Get-IAMAccountPasswordPolicy
```
**Output:**
```
AllowUsersToChangePassword : True
ExpirePasswords : True
HardExpiry : False
MaxPasswordAge : 90
MinimumPasswordLength : 8
PasswordReusePrevention : 20
RequireLowercaseCharacters : True
RequireNumbers : True
RequireSymbols : False
RequireUppercaseCharacters : True
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the password policy for the current account. If no password policy is defined for the account, the command returns a `NoSuchEntity` error.**
```
Get-IAMAccountPasswordPolicy
```
**Output:**
```
AllowUsersToChangePassword : True
ExpirePasswords : True
HardExpiry : False
MaxPasswordAge : 90
MinimumPasswordLength : 8
PasswordReusePrevention : 20
RequireLowercaseCharacters : True
RequireNumbers : True
RequireSymbols : False
RequireUppercaseCharacters : True
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def print_password_policy():
"""
Prints the password policy for the account.
"""
try:
pw_policy = iam.AccountPasswordPolicy()
print("Current account password policy:")
print(
f"\tallow_users_to_change_password: {pw_policy.allow_users_to_change_password}"
)
print(f"\texpire_passwords: {pw_policy.expire_passwords}")
print(f"\thard_expiry: {pw_policy.hard_expiry}")
print(f"\tmax_password_age: {pw_policy.max_password_age}")
print(f"\tminimum_password_length: {pw_policy.minimum_password_length}")
print(f"\tpassword_reuse_prevention: {pw_policy.password_reuse_prevention}")
print(
f"\trequire_lowercase_characters: {pw_policy.require_lowercase_characters}"
)
print(f"\trequire_numbers: {pw_policy.require_numbers}")
print(f"\trequire_symbols: {pw_policy.require_symbols}")
print(
f"\trequire_uppercase_characters: {pw_policy.require_uppercase_characters}"
)
printed = True
except ClientError as error:
if error.response["Error"]["Code"] == "NoSuchEntity":
print("The account does not have a password policy set.")
else:
logger.exception("Couldn't get account password policy.")
raise
else:
return printed
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetAccountPasswordPolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Class to manage IAM account password policies
class PasswordPolicyManager
attr_accessor :iam_client, :logger
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'IAMPolicyManager'
end
# Retrieves and logs the account password policy
def print_account_password_policy
response = @iam_client.get_account_password_policy
@logger.info("The account password policy is: #{response.password_policy.to_h}")
rescue Aws::IAM::Errors::NoSuchEntity
@logger.info('The account does not have a password policy.')
rescue Aws::Errors::ServiceError => e
@logger.error("Couldn't print the account password policy. Error: #{e.code} - #{e.message}")
raise
end
end
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/GetAccountPasswordPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn get_account_password_policy(
client: &iamClient,
) -> Result> {
let response = client.get_account_password_policy().send().await?;
Ok(response)
}
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.get_account_password_policy) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getaccountpasswordpolicy( ).
MESSAGE 'Retrieved account password policy.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'No password policy exists.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when getting password policy.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetAccountPasswordPolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetAccountSummary` with an AWS SDK or CLI
The following code examples show how to use `GetAccountSummary`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ CLI ]
**AWS CLI**
**To get information about IAM entity usage and IAM quotas in the current account**
The following `get-account-summary` command returns information about the current IAM entity usage and current IAM entity quotas in the account.
```
aws iam get-account-summary
```
Output:
```
{
"SummaryMap": {
"UsersQuota": 5000,
"GroupsQuota": 100,
"InstanceProfiles": 6,
"SigningCertificatesPerUserQuota": 2,
"AccountAccessKeysPresent": 0,
"RolesQuota": 250,
"RolePolicySizeQuota": 10240,
"AccountSigningCertificatesPresent": 0,
"Users": 27,
"ServerCertificatesQuota": 20,
"ServerCertificates": 0,
"AssumeRolePolicySizeQuota": 2048,
"Groups": 7,
"MFADevicesInUse": 1,
"Roles": 3,
"AccountMFAEnabled": 1,
"MFADevices": 3,
"GroupsPerUserQuota": 10,
"GroupPolicySizeQuota": 5120,
"InstanceProfilesQuota": 100,
"AccessKeysPerUserQuota": 2,
"Providers": 0,
"UserPolicySizeQuota": 2048
}
}
```
For more information about entity limitations, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *AWS IAM User Guide*.
+ For API details, see [GetAccountSummary](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-account-summary.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns information about the current IAM entity usage and current IAM entity quotas in the AWS account.**
```
Get-IAMAccountSummary
```
**Output:**
```
Key Value
Users 7
GroupPolicySizeQuota 5120
PolicyVersionsInUseQuota 10000
ServerCertificatesQuota 20
AccountSigningCertificatesPresent 0
AccountAccessKeysPresent 0
Groups 3
UsersQuota 5000
RolePolicySizeQuota 10240
UserPolicySizeQuota 2048
GroupsPerUserQuota 10
AssumeRolePolicySizeQuota 2048
AttachedPoliciesPerGroupQuota 2
Roles 9
VersionsPerPolicyQuota 5
GroupsQuota 100
PolicySizeQuota 5120
Policies 5
RolesQuota 250
ServerCertificates 0
AttachedPoliciesPerRoleQuota 2
MFADevicesInUse 2
PoliciesQuota 1000
AccountMFAEnabled 1
Providers 2
InstanceProfilesQuota 100
MFADevices 4
AccessKeysPerUserQuota 2
AttachedPoliciesPerUserQuota 2
SigningCertificatesPerUserQuota 2
PolicyVersionsInUse 4
InstanceProfiles 1
...
```
+ For API details, see [GetAccountSummary](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns information about the current IAM entity usage and current IAM entity quotas in the AWS account.**
```
Get-IAMAccountSummary
```
**Output:**
```
Key Value
Users 7
GroupPolicySizeQuota 5120
PolicyVersionsInUseQuota 10000
ServerCertificatesQuota 20
AccountSigningCertificatesPresent 0
AccountAccessKeysPresent 0
Groups 3
UsersQuota 5000
RolePolicySizeQuota 10240
UserPolicySizeQuota 2048
GroupsPerUserQuota 10
AssumeRolePolicySizeQuota 2048
AttachedPoliciesPerGroupQuota 2
Roles 9
VersionsPerPolicyQuota 5
GroupsQuota 100
PolicySizeQuota 5120
Policies 5
RolesQuota 250
ServerCertificates 0
AttachedPoliciesPerRoleQuota 2
MFADevicesInUse 2
PoliciesQuota 1000
AccountMFAEnabled 1
Providers 2
InstanceProfilesQuota 100
MFADevices 4
AccessKeysPerUserQuota 2
AttachedPoliciesPerUserQuota 2
SigningCertificatesPerUserQuota 2
PolicyVersionsInUse 4
InstanceProfiles 1
...
```
+ For API details, see [GetAccountSummary](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_summary():
"""
Gets a summary of account usage.
:return: The summary of account usage.
"""
try:
summary = iam.AccountSummary()
logger.debug(summary.summary_map)
except ClientError:
logger.exception("Couldn't get a summary for your account.")
raise
else:
return summary.summary_map
```
+ For API details, see [GetAccountSummary](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetAccountSummary) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getaccountsummary( ).
MESSAGE 'Retrieved account summary.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when getting account summary.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetAccountSummary](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetContextKeysForCustomPolicy` with a CLI
The following code examples show how to use `GetContextKeysForCustomPolicy`.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To list the context keys referenced by one or more custom JSON policies provided as a parameter on the command line**
The following `get-context-keys-for-custom-policy` command parses each supplied policy and lists the context keys used by those policies. Use this command to identify which context key values you must supply to successfully use the policy simulator commands `simulate-custom-policy` and `simulate-custom-policy`. You can also retrieve the list of context keys used by all policies associated by an IAM user or role by using the `get-context-keys-for-custom-policy` command. Parameter values that begin with `file://` instruct the command to read the file and use the contents as the value for the parameter instead of the file name itself.
```
aws iam get-context-keys-for-custom-policy \
--policy-input-list '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/${aws:username}","Condition":{"DateGreaterThan":{"aws:CurrentTime":"2015-08-16T12:00:00Z"}}}}'
```
Output:
```
{
"ContextKeyNames": [
"aws:username",
"aws:CurrentTime"
]
}
```
**Example 2: To list the context keys referenced by one or more custom JSON policies provided as a file input**
The following `get-context-keys-for-custom-policy` command is the same as the previous example, except that the policies are provided in a file instead of as a parameter. Because the command expects a JSON list of strings, and not a list of JSON structures, the file must be structured as follows, although you can collapse it into one one.
```
[
"Policy1",
"Policy2"
]
```
So for example, a file that contains the policy from the previous example must look like the following. You must escape each embedded double-quote inside the policy string by preceding it with a backslash ''.
```
[ "{\"Version\": \"2012-10-17\", \"Statement\": {\"Effect\": \"Allow\", \"Action\": \"dynamodb:*\", \"Resource\": \"arn:aws:dynamodb:us-west-2:128716708097:table/${aws:username}\", \"Condition\": {\"DateGreaterThan\": {\"aws:CurrentTime\": \"2015-08-16T12:00:00Z\"}}}}" ]
```
This file can then be submitted to the following command.
```
aws iam get-context-keys-for-custom-policy \
--policy-input-list file://policyfile.json
```
Output:
```
{
"ContextKeyNames": [
"aws:username",
"aws:CurrentTime"
]
}
```
For more information, see [Using the IAM Policy Simulator (AWS CLI and AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html#policies-simulator-using-api) in the *AWS IAM User Guide*.
+ For API details, see [GetContextKeysForCustomPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-context-keys-for-custom-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example fetches all the context keys present in the provided policy json.In order to provide multiple policies you can provide as comma separated list of values.**
```
$policy1 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/","Condition":{"DateGreaterThan":{"aws:CurrentTime":"2015-08-16T12:00:00Z"}}}}'
$policy2 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/"}}'
Get-IAMContextKeysForCustomPolicy -PolicyInputList $policy1,$policy2
```
+ For API details, see [GetContextKeysForCustomPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example fetches all the context keys present in the provided policy json.In order to provide multiple policies you can provide as comma separated list of values.**
```
$policy1 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/","Condition":{"DateGreaterThan":{"aws:CurrentTime":"2015-08-16T12:00:00Z"}}}}'
$policy2 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/"}}'
Get-IAMContextKeysForCustomPolicy -PolicyInputList $policy1,$policy2
```
+ For API details, see [GetContextKeysForCustomPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetContextKeysForPrincipalPolicy` with a CLI
The following code examples show how to use `GetContextKeysForPrincipalPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To list the context keys referenced by all policies associated with an IAM principal**
The following `get-context-keys-for-principal-policy` command retrieves all policies that are attached to the user `saanvi` and any groups she is a member of. It then parses each and lists the context keys used by those policies. Use this command to identify which context key values you must supply to successfully use the `simulate-custom-policy` and `simulate-principal-policy` commands. You can also retrieve the list of context keys used by an arbitrary JSON policy by using the `get-context-keys-for-custom-policy` command.
```
aws iam get-context-keys-for-principal-policy \
--policy-source-arn arn:aws:iam::123456789012:user/saanvi
```
Output:
```
{
"ContextKeyNames": [
"aws:username",
"aws:CurrentTime"
]
}
```
For more information, see [Using the IAM Policy Simulator (AWS CLI and AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html#policies-simulator-using-api) in the *AWS IAM User Guide*.
+ For API details, see [GetContextKeysForPrincipalPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-context-keys-for-principal-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example fetches all the context keys present in the provided policy json and the policies attached to IAM entity(user/role etc.). For -PolicyInputList you can provide multiple values list as comma separated values. **
```
$policy1 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/","Condition":{"DateGreaterThan":{"aws:CurrentTime":"2015-08-16T12:00:00Z"}}}}'
$policy2 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/"}}'
Get-IAMContextKeysForPrincipalPolicy -PolicyInputList $policy1,$policy2 -PolicySourceArn arn:aws:iam::852640994763:user/TestUser
```
+ For API details, see [GetContextKeysForPrincipalPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example fetches all the context keys present in the provided policy json and the policies attached to IAM entity(user/role etc.). For -PolicyInputList you can provide multiple values list as comma separated values. **
```
$policy1 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/","Condition":{"DateGreaterThan":{"aws:CurrentTime":"2015-08-16T12:00:00Z"}}}}'
$policy2 = '{"Version":"2012-10-17", "Statement":{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-west-2:123456789012:table/"}}'
Get-IAMContextKeysForPrincipalPolicy -PolicyInputList $policy1,$policy2 -PolicySourceArn arn:aws:iam::852640994763:user/TestUser
```
+ For API details, see [GetContextKeysForPrincipalPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetCredentialReport` with an AWS SDK or CLI
The following code examples show how to use `GetCredentialReport`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ CLI ]
**AWS CLI**
**To get a credential report**
This example opens the returned report and outputs it to the pipeline as an array of text lines.
```
aws iam get-credential-report
```
Output:
```
{
"GeneratedTime": "2015-06-17T19:11:50Z",
"ReportFormat": "text/csv"
}
```
For more information, see [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) in the *AWS IAM User Guide*.
+ For API details, see [GetCredentialReport](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-credential-report.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example opens the returned report and outputs it to the pipeline as an array of text lines. The first line is the header with comma-separated column names. Each successive row is the detail row for one user, with each field separated by commas. Before you can view the report, you must generate it with the `Request-IAMCredentialReport` cmdlet. To retrieve the report as a single string, use `-Raw` instead of `-AsTextArray`. The alias `-SplitLines` is also accepted for the `-AsTextArray` switch. For the full list of columns in the output consult the service API reference. Note that if you do not use `-AsTextArray` or `-SplitLines`, then you must extract the text from the `.Content` property using the .NET `StreamReader` class.**
```
Request-IAMCredentialReport
```
**Output:**
```
Description State
----------- -----
No report exists. Starting a new report generation task STARTED
```
```
Get-IAMCredentialReport -AsTextArray
```
**Output:**
```
user,arn,user_creation_time,password_enabled,password_last_used,password_last_changed,password_next_rotation,mfa_active,access_key_1_active,access_key_1_last_rotated,access_key_2_active,access_key_2_last_rotated,cert_1_active,cert_1_last_rotated,cert_2_active,cert_2_last_rotated root_account,arn:aws:iam::123456789012:root,2014-10-15T16:31:25+00:00,not_supported,2015-04-20T17:41:10+00:00,not_supported,not_supported,true,false,N/A,false,N/A,false,N/A,false,N/A
Administrator,arn:aws:iam::123456789012:user/Administrator,2014-10-16T16:03:09+00:00,true,2015-04-20T15:18:32+00:00,2014-10-16T16:06:00+00:00,N/A,false,true,2014-12-03T18:53:41+00:00,true,2015-03-25T20:38:14+00:00,false,N/A,false,N/A
Bill,arn:aws:iam::123456789012:user/Bill,2015-04-15T18:27:44+00:00,false,N/A,N/A,N/A,false,false,N/A,false,N/A,false,2015-04-20T20:00:12+00:00,false,N/A
```
+ For API details, see [GetCredentialReport](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example opens the returned report and outputs it to the pipeline as an array of text lines. The first line is the header with comma-separated column names. Each successive row is the detail row for one user, with each field separated by commas. Before you can view the report, you must generate it with the `Request-IAMCredentialReport` cmdlet. To retrieve the report as a single string, use `-Raw` instead of `-AsTextArray`. The alias `-SplitLines` is also accepted for the `-AsTextArray` switch. For the full list of columns in the output consult the service API reference. Note that if you do not use `-AsTextArray` or `-SplitLines`, then you must extract the text from the `.Content` property using the .NET `StreamReader` class.**
```
Request-IAMCredentialReport
```
**Output:**
```
Description State
----------- -----
No report exists. Starting a new report generation task STARTED
```
```
Get-IAMCredentialReport -AsTextArray
```
**Output:**
```
user,arn,user_creation_time,password_enabled,password_last_used,password_last_changed,password_next_rotation,mfa_active,access_key_1_active,access_key_1_last_rotated,access_key_2_active,access_key_2_last_rotated,cert_1_active,cert_1_last_rotated,cert_2_active,cert_2_last_rotated root_account,arn:aws:iam::123456789012:root,2014-10-15T16:31:25+00:00,not_supported,2015-04-20T17:41:10+00:00,not_supported,not_supported,true,false,N/A,false,N/A,false,N/A,false,N/A
Administrator,arn:aws:iam::123456789012:user/Administrator,2014-10-16T16:03:09+00:00,true,2015-04-20T15:18:32+00:00,2014-10-16T16:06:00+00:00,N/A,false,true,2014-12-03T18:53:41+00:00,true,2015-03-25T20:38:14+00:00,false,N/A,false,N/A
Bill,arn:aws:iam::123456789012:user/Bill,2015-04-15T18:27:44+00:00,false,N/A,N/A,N/A,false,false,N/A,false,N/A,false,2015-04-20T20:00:12+00:00,false,N/A
```
+ For API details, see [GetCredentialReport](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_credential_report():
"""
Gets the most recently generated credentials report about the current account.
:return: The credentials report.
"""
try:
response = iam.meta.client.get_credential_report()
logger.debug(response["Content"])
except ClientError:
logger.exception("Couldn't get credentials report.")
raise
else:
return response["Content"]
```
+ For API details, see [GetCredentialReport](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetCredentialReport) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getcredentialreport( ).
MESSAGE 'Retrieved credential report.' TYPE 'I'.
CATCH /aws1/cx_iamcredrptnotpresen00.
MESSAGE 'Credential report not present.' TYPE 'E'.
CATCH /aws1/cx_iamcredrptexpiredex.
MESSAGE 'Credential report expired.' TYPE 'E'.
CATCH /aws1/cx_iamcredrptnotreadyex.
MESSAGE 'Credential report not ready.' TYPE 'E'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when getting credential report.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetCredentialReport](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetGroup` with a CLI
The following code examples show how to use `GetGroup`.
------
#### [ CLI ]
**AWS CLI**
**To get an IAM group**
This example returns details about the IAM group `Admins`.
```
aws iam get-group \
--group-name Admins
```
Output:
```
{
"Group": {
"Path": "/",
"CreateDate": "2015-06-16T19:41:48Z",
"GroupId": "AIDGPMS9RO4H3FEXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/Admins",
"GroupName": "Admins"
},
"Users": []
}
```
For more information, see [IAM Identities (users, user groups, and roles)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) in the *AWS IAM User Guide*.
+ For API details, see [GetGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-group.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the IAM group `Testers`, including a collection of all the IAM users that belong to the group. **
```
$results = Get-IAMGroup -GroupName "Testers"
$results
```
**Output:**
```
Group IsTruncated Marker Users
----- ----------- ------ -----
Amazon.IdentityManagement.Model.Group False {Theresa, David}
```
```
$results.Group
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : 3RHNZZGQJ7QHMAEXAMPLE1
GroupName : Testers
Path : /
```
```
$results.Users
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Theresa
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : 4OSVDDJJTF4XEEXAMPLE2
UserName : Theresa
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE3
UserName : David
```
+ For API details, see [GetGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the IAM group `Testers`, including a collection of all the IAM users that belong to the group. **
```
$results = Get-IAMGroup -GroupName "Testers"
$results
```
**Output:**
```
Group IsTruncated Marker Users
----- ----------- ------ -----
Amazon.IdentityManagement.Model.Group False {Theresa, David}
```
```
$results.Group
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : 3RHNZZGQJ7QHMAEXAMPLE1
GroupName : Testers
Path : /
```
```
$results.Users
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Theresa
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : 4OSVDDJJTF4XEEXAMPLE2
UserName : Theresa
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE3
UserName : David
```
+ For API details, see [GetGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetGroupPolicy` with a CLI
The following code examples show how to use `GetGroupPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To get information about a policy attached to an IAM group**
The following `get-group-policy` command gets information about the specified policy attached to the group named `Test-Group`.
```
aws iam get-group-policy \
--group-name Test-Group \
--policy-name S3-ReadOnly-Policy
```
Output:
```
{
"GroupName": "Test-Group",
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": "*",
"Effect": "Allow"
}
]
},
"PolicyName": "S3-ReadOnly-Policy"
}
```
For more information, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [GetGroupPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-group-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the embedded inline policy named `PowerUserAccess-Testers` for the group `Testers`. The `PolicyDocument` property is URL encoded. It is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMGroupPolicy -GroupName Testers -PolicyName PowerUserAccess-Testers
$results
```
**Output:**
```
GroupName PolicyDocument PolicyName
--------- -------------- ----------
Testers %7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0A%20... PowerUserAccess-Testers
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:555555555555:instance/i-b188560f"
]
}
]
}
```
+ For API details, see [GetGroupPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the embedded inline policy named `PowerUserAccess-Testers` for the group `Testers`. The `PolicyDocument` property is URL encoded. It is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMGroupPolicy -GroupName Testers -PolicyName PowerUserAccess-Testers
$results
```
**Output:**
```
GroupName PolicyDocument PolicyName
--------- -------------- ----------
Testers %7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0A%20... PowerUserAccess-Testers
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:555555555555:instance/i-b188560f"
]
}
]
}
```
+ For API details, see [GetGroupPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetInstanceProfile` with a CLI
The following code examples show how to use `GetInstanceProfile`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
------
#### [ CLI ]
**AWS CLI**
**To get information about an instance profile**
The following `get-instance-profile` command gets information about the instance profile named `ExampleInstanceProfile`.
```
aws iam get-instance-profile \
--instance-profile-name ExampleInstanceProfile
```
Output:
```
{
"InstanceProfile": {
"InstanceProfileId": "AID2MAB8DPLSRHEXAMPLE",
"Roles": [
{
"AssumeRolePolicyDocument": "",
"RoleId": "AIDGPMS9RO4H3FEXAMPLE",
"CreateDate": "2013-01-09T06:33:26Z",
"RoleName": "Test-Role",
"Path": "/",
"Arn": "arn:aws:iam::336924118301:role/Test-Role"
}
],
"CreateDate": "2013-06-12T23:52:02Z",
"InstanceProfileName": "ExampleInstanceProfile",
"Path": "/",
"Arn": "arn:aws:iam::336924118301:instance-profile/ExampleInstanceProfile"
}
}
```
For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [GetInstanceProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-instance-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details of the instance profile named `ec2instancerole` that is defined in the current AWS account.**
```
Get-IAMInstanceProfile -InstanceProfileName ec2instancerole
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [GetInstanceProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details of the instance profile named `ec2instancerole` that is defined in the current AWS account.**
```
Get-IAMInstanceProfile -InstanceProfileName ec2instancerole
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [GetInstanceProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetLoginProfile` with a CLI
The following code examples show how to use `GetLoginProfile`.
------
#### [ CLI ]
**AWS CLI**
**To get password information for an IAM user**
The following `get-login-profile` command gets information about the password for the IAM user named `Bob`.
```
aws iam get-login-profile \
--user-name Bob
```
Output:
```
{
"LoginProfile": {
"UserName": "Bob",
"CreateDate": "2012-09-21T23:03:39Z"
}
}
```
The `get-login-profile` command can be used to verify that an IAM user has a password. The command returns a `NoSuchEntity` error if no password is defined for the user.
You cannot view a password using this command. If the password is lost, you can reset the password (`update-login-profile`) for the user. Alternatively, you can delete the login profile (`delete-login-profile`) for the user and then create a new one (`create-login-profile`).
For more information, see [Managing passwords for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html) in the *AWS IAM User Guide*.
+ For API details, see [GetLoginProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-login-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the password creation date and whether a password reset is required for the IAM user `David`.**
```
Get-IAMLoginProfile -UserName David
```
**Output:**
```
CreateDate PasswordResetRequired UserName
---------- --------------------- --------
12/10/2014 3:39:44 PM False David
```
+ For API details, see [GetLoginProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the password creation date and whether a password reset is required for the IAM user `David`.**
```
Get-IAMLoginProfile -UserName David
```
**Output:**
```
CreateDate PasswordResetRequired UserName
---------- --------------------- --------
12/10/2014 3:39:44 PM False David
```
+ For API details, see [GetLoginProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetOpenIdConnectProvider` with a CLI
The following code examples show how to use `GetOpenIdConnectProvider`.
------
#### [ CLI ]
**AWS CLI**
**To return information about the specified OpenID Connect provider**
This example returns details about the OpenID Connect provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/server.example.com`.
```
aws iam get-open-id-connect-provider \
--open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/server.example.com
```
Output:
```
{
"Url": "server.example.com"
"CreateDate": "2015-06-16T19:41:48Z",
"ThumbprintList": [
"12345abcdefghijk67890lmnopqrst987example"
],
"ClientIDList": [
"example-application-ID"
]
}
```
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [GetOpenIdConnectProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-open-id-connect-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the OpenID Connect provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/accounts.google.com`. The `ClientIDList` property is a collection that contains all the Client IDs defined for this provider.**
```
Get-IAMOpenIDConnectProvider -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/oidc.example.com
```
**Output:**
```
ClientIDList CreateDate ThumbprintList Url
------------ ---------- -------------- ---
{MyOIDCApp} 2/3/2015 3:00:30 PM {12345abcdefghijk67890lmnopqrst98765uvwxy} oidc.example.com
```
+ For API details, see [GetOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the OpenID Connect provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/accounts.google.com`. The `ClientIDList` property is a collection that contains all the Client IDs defined for this provider.**
```
Get-IAMOpenIDConnectProvider -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/oidc.example.com
```
**Output:**
```
ClientIDList CreateDate ThumbprintList Url
------------ ---------- -------------- ---
{MyOIDCApp} 2/3/2015 3:00:30 PM {12345abcdefghijk67890lmnopqrst98765uvwxy} oidc.example.com
```
+ For API details, see [GetOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetPolicy` with an AWS SDK or CLI
The following code examples show how to use `GetPolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Work with the IAM Policy Builder API](iam_example_iam_Scenario_IamPolicyBuilder_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Get information about an IAM policy.
///
/// The IAM policy to retrieve information for.
/// The IAM policy.
public async Task GetPolicyAsync(string policyArn)
{
var response = await _IAMService.GetPolicyAsync(new GetPolicyRequest { PolicyArn = policyArn });
return response.Policy;
}
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/GetPolicy) in *AWS SDK for .NET API Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::getPolicy(const Aws::String &policyArn,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::GetPolicyRequest request;
request.SetPolicyArn(policyArn);
auto outcome = iam.GetPolicy(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error getting policy " << policyArn << ": " <<
outcome.GetError().GetMessage() << std::endl;
}
else {
const auto &policy = outcome.GetResult().GetPolicy();
std::cout << "Name: " << policy.GetPolicyName() << std::endl <<
"ID: " << policy.GetPolicyId() << std::endl << "Arn: " <<
policy.GetArn() << std::endl << "Description: " <<
policy.GetDescription() << std::endl << "CreateDate: " <<
policy.GetCreateDate().ToGmtString(Aws::Utils::DateFormat::ISO_8601)
<< std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/GetPolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To retrieve information about the specified managed policy**
This example returns details about the managed policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.
```
aws iam get-policy \
--policy-arn arn:aws:iam::123456789012:policy/MySamplePolicy
```
Output:
```
{
"Policy": {
"PolicyName": "MySamplePolicy",
"CreateDate": "2015-06-17T19:23;32Z",
"AttachmentCount": 0,
"IsAttachable": true,
"PolicyId": "Z27SI6FQMGNQ2EXAMPLE1",
"DefaultVersionId": "v1",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:policy/MySamplePolicy",
"UpdateDate": "2015-06-17T19:23:32Z"
}
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [GetPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// PolicyWrapper encapsulates AWS Identity and Access Management (IAM) policy actions
// used in the examples.
// It contains an IAM service client that is used to perform policy actions.
type PolicyWrapper struct {
IamClient *iam.Client
}
// GetPolicy gets data about a policy.
func (wrapper PolicyWrapper) GetPolicy(ctx context.Context, policyArn string) (*types.Policy, error) {
var policy *types.Policy
result, err := wrapper.IamClient.GetPolicy(ctx, &iam.GetPolicyInput{
PolicyArn: aws.String(policyArn),
})
if err != nil {
log.Printf("Couldn't get policy %v. Here's why: %v\n", policyArn, err)
} else {
policy = result.Policy
}
return policy, err
}
```
+ For API details, see [GetPolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.GetPolicy) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Get the policy.
```
import { GetPolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} policyArn
*/
export const getPolicy = (policyArn) => {
const command = new GetPolicyCommand({
PolicyArn: policyArn,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-policies.html#iam-examples-policies-getting).
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetPolicyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
PolicyArn: "arn:aws:iam::aws:policy/AWSLambdaExecute",
};
iam.getPolicy(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data.Policy.Description);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-policies.html#iam-examples-policies-getting).
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/GetPolicy) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun getIAMPolicy(policyArnVal: String?) {
val request =
GetPolicyRequest {
policyArn = policyArnVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.getPolicy(request)
println("Successfully retrieved policy ${response.policy?.policyName}")
}
}
```
+ For API details, see [GetPolicy](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function getPolicy($policyArn)
{
return $this->customWaiter(function () use ($policyArn) {
return $this->iamClient->getPolicy(['PolicyArn' => $policyArn]);
});
}
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/GetPolicy) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the managed policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.**
```
Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
```
**Output:**
```
Arn : arn:aws:iam::aws:policy/MySamplePolicy
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:08 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : Z27SI6FQMGNQ2EXAMPLE1
PolicyName : MySamplePolicy
UpdateDate : 2/6/2015 10:40:08 AM
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the managed policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.**
```
Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy
```
**Output:**
```
Arn : arn:aws:iam::aws:policy/MySamplePolicy
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:08 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : Z27SI6FQMGNQ2EXAMPLE1
PolicyName : MySamplePolicy
UpdateDate : 2/6/2015 10:40:08 AM
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_default_policy_statement(policy_arn):
"""
Gets the statement of the default version of the specified policy.
:param policy_arn: The ARN of the policy to look up.
:return: The statement of the default policy version.
"""
try:
policy = iam.Policy(policy_arn)
# To get an attribute of a policy, the SDK first calls get_policy.
policy_doc = policy.default_version.document
policy_statement = policy_doc.get("Statement", None)
logger.info("Got default policy doc for %s.", policy.policy_name)
logger.info(policy_doc)
except ClientError:
logger.exception("Couldn't get default policy statement for %s.", policy_arn)
raise
else:
return policy_statement
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetPolicy) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/GetPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getpolicy( iv_policyarn = iv_policy_arn ).
MESSAGE 'Retrieved policy information.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetPolicy](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func getPolicy(arn: String) async throws -> IAMClientTypes.Policy {
let input = GetPolicyInput(
policyArn: arn
)
do {
let output = try await client.getPolicy(input: input)
guard let policy = output.policy else {
throw ServiceHandlerError.noSuchPolicy
}
return policy
} catch {
print("ERROR: getPolicy:", dump(error))
throw error
}
}
```
+ For API details, see [GetPolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/getpolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `GetPolicyVersion` with an AWS SDK or CLI
The following code examples show how to use `GetPolicyVersion`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Work with the IAM Policy Builder API](iam_example_iam_Scenario_IamPolicyBuilder_section.md)
------
#### [ CLI ]
**AWS CLI**
**To retrieve information about the specified version of the specified managed policy**
This example returns the policy document for the v2 version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyManagedPolicy`.
```
aws iam get-policy-version \
--policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--version-id v2
```
Output:
```
{
"PolicyVersion": {
"Document": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:*",
"Resource": "*"
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2023-04-11T00:22:54+00:00"
}
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [GetPolicyVersion](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-policy-version.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the policy document for the `v2` version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyManagedPolicy`. The policy document in the `Document` property is URL encoded and is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyManagedPolicy -VersionId v2
$results
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
2/12/2015 9:39:53 AM %7B%0A%20%20%22Version%22%3A%20%222012-10... True v2
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
$policy = [System.Web.HttpUtility]::UrlDecode($results.Document)
$policy
{
"Version":"2012-10-17",
"Statement":
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:555555555555:instance/i-b188560f"
]
}
}
```
+ For API details, see [GetPolicyVersion](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the policy document for the `v2` version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyManagedPolicy`. The policy document in the `Document` property is URL encoded and is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyManagedPolicy -VersionId v2
$results
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
2/12/2015 9:39:53 AM %7B%0A%20%20%22Version%22%3A%20%222012-10... True v2
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
$policy = [System.Web.HttpUtility]::UrlDecode($results.Document)
$policy
{
"Version":"2012-10-17",
"Statement":
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:555555555555:instance/i-b188560f"
]
}
}
```
+ For API details, see [GetPolicyVersion](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_default_policy_statement(policy_arn):
"""
Gets the statement of the default version of the specified policy.
:param policy_arn: The ARN of the policy to look up.
:return: The statement of the default policy version.
"""
try:
policy = iam.Policy(policy_arn)
# To get an attribute of a policy, the SDK first calls get_policy.
policy_doc = policy.default_version.document
policy_statement = policy_doc.get("Statement", None)
logger.info("Got default policy doc for %s.", policy.policy_name)
logger.info(policy_doc)
except ClientError:
logger.exception("Couldn't get default policy statement for %s.", policy_arn)
raise
else:
return policy_statement
```
+ For API details, see [GetPolicyVersion](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetPolicyVersion) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getpolicyversion(
iv_policyarn = iv_policy_arn
iv_versionid = iv_version_id ).
MESSAGE 'Retrieved policy version information.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy or version does not exist.' TYPE 'E'.
CATCH /aws1/cx_iaminvalidinputex.
MESSAGE 'Invalid input provided.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetPolicyVersion](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `GetRole` with an AWS SDK or CLI
The following code examples show how to use `GetRole`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Configure Amazon ECS Service Connect](iam_example_ecs_ServiceConnect_085_section.md)
+ [Create an Amazon ECS Linux task for the Fargate launch type](iam_example_ecs_GettingStarted_086_section.md)
+ [Creating an Amazon ECS service for the EC2 launch type](iam_example_ecs_GettingStarted_018_section.md)
+ [Get started with Redshift Serverless](iam_example_redshift_GettingStarted_038_section.md)
+ [Getting started with Amazon EKS](iam_example_eks_GettingStarted_034_section.md)
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Getting started with Amazon Redshift provisioned clusters](iam_example_redshift_GettingStarted_039_section.md)
+ [Getting started with Amazon SageMaker Feature Store](iam_example_iam_GettingStarted_028_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Get information about an IAM role.
///
/// The name of the IAM role to retrieve information
/// for.
/// The IAM role that was retrieved.
public async Task GetRoleAsync(string roleName)
{
var response = await _IAMService.GetRoleAsync(new GetRoleRequest
{
RoleName = roleName,
});
return response.Role;
}
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/GetRole) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To get information about an IAM role**
The following `get-role` command gets information about the role named `Test-Role`.
```
aws iam get-role \
--role-name Test-Role
```
Output:
```
{
"Role": {
"Description": "Test Role",
"AssumeRolePolicyDocument":"",
"MaxSessionDuration": 3600,
"RoleId": "AROA1234567890EXAMPLE",
"CreateDate": "2019-11-13T16:45:56Z",
"RoleName": "Test-Role",
"Path": "/",
"RoleLastUsed": {
"Region": "us-east-1",
"LastUsedDate": "2019-11-13T17:14:00Z"
},
"Arn": "arn:aws:iam::123456789012:role/Test-Role"
}
}
```
The command displays the trust policy attached to the role. To list the permissions policies attached to a role, use the `list-role-policies` command.
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
+ For API details, see [GetRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-role.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// GetRole gets data about a role.
func (wrapper RoleWrapper) GetRole(ctx context.Context, roleName string) (*types.Role, error) {
var role *types.Role
result, err := wrapper.IamClient.GetRole(ctx,
&iam.GetRoleInput{RoleName: aws.String(roleName)})
if err != nil {
log.Printf("Couldn't get role %v. Here's why: %v\n", roleName, err)
} else {
role = result.Role
}
return role, err
}
```
+ For API details, see [GetRole](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.GetRole) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Get the role.
```
import { GetRoleCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} roleName
*/
export const getRole = (roleName) => {
const command = new GetRoleCommand({
RoleName: roleName,
});
return client.send(command);
};
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetRoleCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function getRole($roleName)
{
return $this->customWaiter(function () use ($roleName) {
return $this->iamClient->getRole(['RoleName' => $roleName]);
});
}
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/GetRole) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the details of the `lamda_exec_role`. It includes the trust policy document that specifies who can assume this role. The policy document is URL encoded and can be decoded using the .NET `UrlDecode` method. In this example, the original policy had all white space removed before it was uploaded to the policy. To see the permissions policy documents that determine what someone who assumes the role can do, use the `Get-IAMRolePolicy` for inline policies, and `Get-IAMPolicyVersion` for attached managed policies.**
```
$results = Get-IamRole -RoleName lambda_exec_role
$results | Format-List
```
**Output:**
```
Arn : arn:aws:iam::123456789012:role/lambda_exec_role
AssumeRolePolicyDocument : %7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22
%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service
%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole
%22%7D%5D%7D
CreateDate : 4/2/2015 9:16:11 AM
Path : /
RoleId : 2YBIKAIBHNKB4EXAMPLE1
RoleName : lambda_exec_role
```
```
$policy = [System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument)
$policy
```
**Output:**
```
{"Version":"2012-10-17", "Statement":[{"Sid":"","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the details of the `lamda_exec_role`. It includes the trust policy document that specifies who can assume this role. The policy document is URL encoded and can be decoded using the .NET `UrlDecode` method. In this example, the original policy had all white space removed before it was uploaded to the policy. To see the permissions policy documents that determine what someone who assumes the role can do, use the `Get-IAMRolePolicy` for inline policies, and `Get-IAMPolicyVersion` for attached managed policies.**
```
$results = Get-IamRole -RoleName lambda_exec_role
$results | Format-List
```
**Output:**
```
Arn : arn:aws:iam::123456789012:role/lambda_exec_role
AssumeRolePolicyDocument : %7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22
%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service
%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole
%22%7D%5D%7D
CreateDate : 4/2/2015 9:16:11 AM
Path : /
RoleId : 2YBIKAIBHNKB4EXAMPLE1
RoleName : lambda_exec_role
```
```
$policy = [System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument)
$policy
```
**Output:**
```
{"Version":"2012-10-17", "Statement":[{"Sid":"","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def get_role(role_name):
"""
Gets a role by name.
:param role_name: The name of the role to retrieve.
:return: The specified role.
"""
try:
role = iam.Role(role_name)
role.load() # calls GetRole to load attributes
logger.info("Got role with arn %s.", role.arn)
except ClientError:
logger.exception("Couldn't get role named %s.", role_name)
raise
else:
return role
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/GetRole) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Gets data about a role.
#
# @param name [String] The name of the role to look up.
# @return [Aws::IAM::Role] The retrieved role.
def get_role(name)
role = @iam_client.get_role({
role_name: name
}).role
puts("Got data for role '#{role.role_name}'. Its ARN is '#{role.arn}'.")
rescue Aws::Errors::ServiceError => e
puts("Couldn't get data for role '#{name}' Here's why:")
puts("\t#{e.code}: #{e.message}")
raise
else
role
end
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/GetRole) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn get_role(
client: &iamClient,
role_name: String,
) -> Result> {
let response = client.get_role().role_name(role_name).send().await?;
Ok(response)
}
```
+ For API details, see [GetRole](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.get_role) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->getrole( iv_rolename = iv_role_name ).
MESSAGE 'Retrieved role information.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [GetRole](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func getRole(name: String) async throws -> IAMClientTypes.Role {
let input = GetRoleInput(
roleName: name
)
do {
let output = try await client.getRole(input: input)
guard let role = output.role else {
throw ServiceHandlerError.noSuchRole
}
return role
} catch {
print("ERROR: getRole:", dump(error))
throw error
}
}
```
+ For API details, see [GetRole](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/getrole(input:)) in *AWS SDK for Swift API reference*.
------
# Use `GetRolePolicy` with a CLI
The following code examples show how to use `GetRolePolicy`.
------
#### [ CLI ]
**AWS CLI**
**To get information about a policy attached to an IAM role**
The following `get-role-policy` command gets information about the specified policy attached to the role named `Test-Role`.
```
aws iam get-role-policy \
--role-name Test-Role \
--policy-name ExamplePolicy
```
Output:
```
{
"RoleName": "Test-Role",
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:ListBucket",
"s3:Put*",
"s3:Get*",
"s3:*MultipartUpload*"
],
"Resource": "*",
"Effect": "Allow",
"Sid": "1"
}
]
}
"PolicyName": "ExamplePolicy"
}
```
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
+ For API details, see [GetRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the permissions policy document for the policy named `oneClick_lambda_exec_role_policy` that is embedded in the IAM role `lamda_exec_role`. The resulting policy document is URL encoded. It is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMRolePolicy -RoleName lambda_exec_role -PolicyName oneClick_lambda_exec_role_policy
$results
```
**Output:**
```
PolicyDocument PolicyName UserName
-------------- ---------- --------
%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%... oneClick_lambda_exec_role_policy lambda_exec_role
```
```
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
```
**Output:**
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "arn:aws:logs:us-east-1:555555555555:log-group:/aws/lambda/aws-example-function:*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket/*"
]
}
]
}
```
+ For API details, see [GetRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the permissions policy document for the policy named `oneClick_lambda_exec_role_policy` that is embedded in the IAM role `lamda_exec_role`. The resulting policy document is URL encoded. It is decoded in this example with the `UrlDecode` .NET method.**
```
$results = Get-IAMRolePolicy -RoleName lambda_exec_role -PolicyName oneClick_lambda_exec_role_policy
$results
```
**Output:**
```
PolicyDocument PolicyName UserName
-------------- ---------- --------
%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%... oneClick_lambda_exec_role_policy lambda_exec_role
```
```
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
```
**Output:**
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "arn:aws:logs:us-east-1:555555555555:log-group:/aws/lambda/aws-example-function:*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::amzn-s3-demo-bucket/*"
]
}
]
}
```
+ For API details, see [GetRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetSamlProvider` with a CLI
The following code examples show how to use `GetSamlProvider`.
------
#### [ CLI ]
**AWS CLI**
**To retrieve the SAML provider metadocument**
This example retrieves the details about the SAML 2.0 provider whose ARM is `arn:aws:iam::123456789012:saml-provider/SAMLADFS`. The response includes the metadata document that you got from the identity provider to create the AWS SAML provider entity as well as the creation and expiration dates.
```
aws iam get-saml-provider \
--saml-provider-arn arn:aws:iam::123456789012:saml-provider/SAMLADFS
```
Output:
```
{
"SAMLMetadataDocument": "...SAMLMetadataDocument-XML...",
"CreateDate": "2017-03-06T22:29:46+00:00",
"ValidUntil": "2117-03-06T22:29:46.433000+00:00",
"Tags": [
{
"Key": "DeptID",
"Value": "123456"
},
{
"Key": "Department",
"Value": "Accounting"
}
]
}
```
For more information, see [Creating IAM SAML identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) in the *AWS IAM User Guide*.
+ For API details, see [GetSamlProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-saml-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves the details about the SAML 2.0 provider whose ARM is arn:aws:iam::123456789012:saml-provider/SAMLADFS. The response includes the metadata document that you got from the identity provider to create the AWS SAML provider entity as well as the creation and expiration dates.**
```
Get-IAMSAMLProvider -SAMLProviderArn arn:aws:iam::123456789012:saml-provider/SAMLADFS
```
**Output:**
```
CreateDate SAMLMetadataDocument ValidUntil
---------- -------------------- ----------
12/23/2014 12:16:55 PM
The following code examples show how to use `GetServerCertificate`.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::getServerCertificate(const Aws::String &certificateName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::GetServerCertificateRequest request;
request.SetServerCertificateName(certificateName);
auto outcome = iam.GetServerCertificate(request);
bool result = true;
if (!outcome.IsSuccess()) {
if (outcome.GetError().GetErrorType() != Aws::IAM::IAMErrors::NO_SUCH_ENTITY) {
std::cerr << "Error getting server certificate " << certificateName <<
": " << outcome.GetError().GetMessage() << std::endl;
result = false;
}
else {
std::cout << "Certificate '" << certificateName
<< "' not found." << std::endl;
}
}
else {
const auto &certificate = outcome.GetResult().GetServerCertificate();
std::cout << "Name: " <<
certificate.GetServerCertificateMetadata().GetServerCertificateName()
<< std::endl << "Body: " << certificate.GetCertificateBody() <<
std::endl << "Chain: " << certificate.GetCertificateChain() <<
std::endl;
}
return result;
}
```
+ For API details, see [GetServerCertificate](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/GetServerCertificate) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To get details about a server certificate in your AWS account**
The following `get-server-certificate` command retrieves all of the details about the specified server certificate in your AWS account.
```
aws iam get-server-certificate \
--server-certificate-name myUpdatedServerCertificate
```
Output:
```
{
"ServerCertificate": {
"ServerCertificateMetadata": {
"Path": "/",
"ServerCertificateName": "myUpdatedServerCertificate",
"ServerCertificateId": "ASCAEXAMPLE123EXAMPLE",
"Arn": "arn:aws:iam::123456789012:server-certificate/myUpdatedServerCertificate",
"UploadDate": "2019-04-22T21:13:44+00:00",
"Expiration": "2019-10-15T22:23:16+00:00"
},
"CertificateBody": "-----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvrszlaEXAMPLE=-----END CERTIFICATE-----",
"CertificateChain": "-----BEGIN CERTIFICATE-----\nMIICiTCCAfICCQD6md
7oRw0uXOjANBgkqhkiG9w0BAqQUFADCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AldBMRAwDgYDVQQHEwdTZWF0drGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAs
TC0lBTSBDb25zb2xlMRIwEAYDVsQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQ
jb20wHhcNMTEwNDI1MjA0NTIxWhtcNMTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBh
MCVVMxCzAJBgNVBAgTAldBMRAwDgsYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBb
WF6b24xFDASBgNVBAsTC0lBTSBDb2d5zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMx
HzAdBgkqhkiG9w0BCQEWEG5vb25lQGfFtYXpvbi5jb20wgZ8wDQYJKoZIhvcNAQE
BBQADgY0AMIGJAoGBAMaK0dn+a4GmWIgWJ21uUSfwfEvySWtC2XADZ4nB+BLYgVI
k60CpiwsZ3G93vUEIO3IyNoH/f0wYK8mh9TrDHudUZg3qX4waLG5M43q7Wgc/MbQ
ITxOUSQv7c7ugFFDzQGBzZswY6786m86gjpEIbb3OhjZnzcvQAaRHhdlQWIMm2nr
AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCku4nUhVVxYUntneD9+h8Mg9q6q+auN
KyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0FlkbFFBjvSfpJIlJ00zbhNYS5f6Guo
EDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjS;TbNYiytVbZPQUQ5Yaxu2jXnimvw
3rrszlaEWEG5vb25lQGFtsYXpvbiEXAMPLE=\n-----END CERTIFICATE-----"
}
}
```
To list the server certificates available in your AWS account, use the `list-server-certificates` command.
For more information, see [Managing server certificates in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) in the *AWS IAM User Guide*.
+ For API details, see [GetServerCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-server-certificate.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Get a server certificate.
```
import { GetServerCertificateCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} certName
* @returns
*/
export const getServerCertificate = async (certName) => {
const command = new GetServerCertificateCommand({
ServerCertificateName: certName,
});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-getting).
+ For API details, see [GetServerCertificate](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetServerCertificateCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.getServerCertificate(
{ ServerCertificateName: "CERTIFICATE_NAME" },
function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
}
);
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-getting).
+ For API details, see [GetServerCertificate](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/GetServerCertificate) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves details about the server certificate named `MyServerCertificate`. You can find the certificate details in the `CertificateBody` and `ServerCertificateMetadata` properties.**
```
$result = Get-IAMServerCertificate -ServerCertificateName MyServerCertificate
$result | format-list
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateChain :
ServerCertificateMetadata : Amazon.IdentityManagement.Model.ServerCertificateMetadata
```
```
$result.ServerCertificateMetadata
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate
Expiration : 1/14/2018 9:52:36 AM
Path : /Org1/Org2/
ServerCertificateId : ASCAJIFEXAMPLE17HQZYW
ServerCertificateName : MyServerCertificate
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [GetServerCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves details about the server certificate named `MyServerCertificate`. You can find the certificate details in the `CertificateBody` and `ServerCertificateMetadata` properties.**
```
$result = Get-IAMServerCertificate -ServerCertificateName MyServerCertificate
$result | format-list
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateChain :
ServerCertificateMetadata : Amazon.IdentityManagement.Model.ServerCertificateMetadata
```
```
$result.ServerCertificateMetadata
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate
Expiration : 1/14/2018 9:52:36 AM
Path : /Org1/Org2/
ServerCertificateId : ASCAJIFEXAMPLE17HQZYW
ServerCertificateName : MyServerCertificate
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [GetServerCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetServiceLastAccessedDetails` with a CLI
The following code examples show how to use `GetServiceLastAccessedDetails`.
------
#### [ CLI ]
**AWS CLI**
**To retrieve a service access report**
The following `get-service-last-accessed-details` example retrieves a previously generated report that lists the services accessed by IAM entities. To generate a report, use the `generate-service-last-accessed-details` command.
```
aws iam get-service-last-accessed-details \
--job-id 2eb6c2b8-7b4c-3xmp-3c13-03b72c8cdfdc
```
Output:
```
{
"JobStatus": "COMPLETED",
"JobCreationDate": "2019-10-01T03:50:35.929Z",
"ServicesLastAccessed": [
...
{
"ServiceName": "AWS Lambda",
"LastAuthenticated": "2019-09-30T23:02:00Z",
"ServiceNamespace": "lambda",
"LastAuthenticatedEntity": "arn:aws:iam::123456789012:user/admin",
"TotalAuthenticatedEntities": 6
},
]
}
```
For more information, see [Refining permissions in AWS using last accessed information](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html) in the *AWS IAM User Guide*.
+ For API details, see [GetServiceLastAccessedDetails](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-service-last-accessed-details.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example provides details of the service last accessed by the IAM entity(user, group, role or policy) associated in Request call. **
```
Request-IAMServiceLastAccessedDetail -Arn arn:aws:iam::123456789012:user/TestUser
```
**Output:**
```
f0b7a819-eab0-929b-dc26-ca598911cb9f
```
```
Get-IAMServiceLastAccessedDetail -JobId f0b7a819-eab0-929b-dc26-ca598911cb9f
```
+ For API details, see [GetServiceLastAccessedDetails](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example provides details of the service last accessed by the IAM entity(user, group, role or policy) associated in Request call. **
```
Request-IAMServiceLastAccessedDetail -Arn arn:aws:iam::123456789012:user/TestUser
```
**Output:**
```
f0b7a819-eab0-929b-dc26-ca598911cb9f
```
```
Get-IAMServiceLastAccessedDetail -JobId f0b7a819-eab0-929b-dc26-ca598911cb9f
```
+ For API details, see [GetServiceLastAccessedDetails](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetServiceLastAccessedDetailsWithEntities` with a CLI
The following code examples show how to use `GetServiceLastAccessedDetailsWithEntities`.
------
#### [ CLI ]
**AWS CLI**
**To retrieve a service access report with details for a service**
The following `get-service-last-accessed-details-with-entities` example retrieves a report that contains details about IAM users and other entities that accessed the specified service. To generate a report, use the `generate-service-last-accessed-details` command. To get a list of services accessed with namespaces, use `get-service-last-accessed-details`.
```
aws iam get-service-last-accessed-details-with-entities \
--job-id 78b6c2ba-d09e-6xmp-7039-ecde30b26916 \
--service-namespace lambda
```
Output:
```
{
"JobStatus": "COMPLETED",
"JobCreationDate": "2019-10-01T03:55:41.756Z",
"JobCompletionDate": "2019-10-01T03:55:42.533Z",
"EntityDetailsList": [
{
"EntityInfo": {
"Arn": "arn:aws:iam::123456789012:user/admin",
"Name": "admin",
"Type": "USER",
"Id": "AIDAIO2XMPLENQEXAMPLE",
"Path": "/"
},
"LastAuthenticated": "2019-09-30T23:02:00Z"
},
{
"EntityInfo": {
"Arn": "arn:aws:iam::123456789012:user/developer",
"Name": "developer",
"Type": "USER",
"Id": "AIDAIBEYXMPL2YEXAMPLE",
"Path": "/"
},
"LastAuthenticated": "2019-09-16T19:34:00Z"
}
]
}
```
For more information, see [Refining permissions in AWS using last accessed information](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html) in the *AWS IAM User Guide*.
+ For API details, see [GetServiceLastAccessedDetailsWithEntities](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-service-last-accessed-details-with-entities.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example provides the last accessed timestamp for the service in the request by that respective IAM entity.**
```
$results = Get-IAMServiceLastAccessedDetailWithEntity -JobId f0b7a819-eab0-929b-dc26-ca598911cb9f -ServiceNamespace ec2
$results
```
**Output:**
```
EntityDetailsList : {Amazon.IdentityManagement.Model.EntityDetails}
Error :
IsTruncated : False
JobCompletionDate : 12/29/19 11:19:31 AM
JobCreationDate : 12/29/19 11:19:31 AM
JobStatus : COMPLETED
Marker :
```
```
$results.EntityDetailsList
```
**Output:**
```
EntityInfo LastAuthenticated
---------- -----------------
Amazon.IdentityManagement.Model.EntityInfo 11/16/19 3:47:00 PM
```
```
$results.EntityInfo
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/TestUser
Id : AIDA4NBK5CXF5TZHU1234
Name : TestUser
Path : /
Type : USER
```
+ For API details, see [GetServiceLastAccessedDetailsWithEntities](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example provides the last accessed timestamp for the service in the request by that respective IAM entity.**
```
$results = Get-IAMServiceLastAccessedDetailWithEntity -JobId f0b7a819-eab0-929b-dc26-ca598911cb9f -ServiceNamespace ec2
$results
```
**Output:**
```
EntityDetailsList : {Amazon.IdentityManagement.Model.EntityDetails}
Error :
IsTruncated : False
JobCompletionDate : 12/29/19 11:19:31 AM
JobCreationDate : 12/29/19 11:19:31 AM
JobStatus : COMPLETED
Marker :
```
```
$results.EntityDetailsList
```
**Output:**
```
EntityInfo LastAuthenticated
---------- -----------------
Amazon.IdentityManagement.Model.EntityInfo 11/16/19 3:47:00 PM
```
```
$results.EntityInfo
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/TestUser
Id : AIDA4NBK5CXF5TZHU1234
Name : TestUser
Path : /
Type : USER
```
+ For API details, see [GetServiceLastAccessedDetailsWithEntities](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `GetServiceLinkedRoleDeletionStatus` with an AWS SDK or CLI
The following code examples show how to use `GetServiceLinkedRoleDeletionStatus`.
------
#### [ CLI ]
**AWS CLI**
**To check the status of a request to delete a service-linked role**
The following `get-service-linked-role-deletion-status` example displays the status of a previously request to delete a service-linked role. The delete operation occurs asynchronously. When you make the request, you get a `DeletionTaskId` value that you provide as a parameter for this command.
```
aws iam get-service-linked-role-deletion-status \
--deletion-task-id task/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots/1a2b3c4d-1234-abcd-7890-abcdeEXAMPLE
```
Output:
```
{
"Status": "SUCCEEDED"
}
```
For more information, see [Using service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html) in the *AWS IAM User Guide*.
+ For API details, see [GetServiceLinkedRoleDeletionStatus](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-service-linked-role-deletion-status.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import {
GetServiceLinkedRoleDeletionStatusCommand,
IAMClient,
} from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} deletionTaskId
*/
export const getServiceLinkedRoleDeletionStatus = (deletionTaskId) => {
const command = new GetServiceLinkedRoleDeletionStatusCommand({
DeletionTaskId: deletionTaskId,
});
return client.send(command);
};
```
+ For API details, see [GetServiceLinkedRoleDeletionStatus](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/GetServiceLinkedRoleDeletionStatusCommand) in *AWS SDK for JavaScript API Reference*.
------
# Use `GetUser` with an AWS SDK or CLI
The following code examples show how to use `GetUser`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Get information about an IAM user.
///
/// The username of the user.
/// An IAM user object.
public async Task GetUserAsync(string userName)
{
var response = await _IAMService.GetUserAsync(new GetUserRequest { UserName = userName });
return response.User;
}
```
+ For API details, see [GetUser](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/GetUser) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_user_exists
#
# This function checks to see if the specified AWS Identity and Access Management (IAM) user already exists.
#
# Parameters:
# $1 - The name of the IAM user to check.
#
# Returns:
# 0 - If the user already exists.
# 1 - If the user doesn't exist.
###############################################################################
function iam_user_exists() {
local user_name
user_name=$1
# Check whether the IAM user already exists.
# We suppress all output - we're interested only in the return code.
local errors
errors=$(aws iam get-user \
--user-name "$user_name" 2>&1 >/dev/null)
local error_code=${?}
if [[ $error_code -eq 0 ]]; then
return 0 # 0 in Bash script means true.
else
if [[ $errors != *"error"*"(NoSuchEntity)"* ]]; then
aws_cli_error_log $error_code
errecho "Error calling iam get-user $errors"
fi
return 1 # 1 in Bash script means false.
fi
}
```
+ For API details, see [GetUser](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/GetUser) in *AWS CLI Command Reference*.
------
#### [ CLI ]
**AWS CLI**
**To get information about an IAM user**
The following `get-user` command gets information about the IAM user named `Paulo`.
```
aws iam get-user \
--user-name Paulo
```
Output:
```
{
"User": {
"UserName": "Paulo",
"Path": "/",
"CreateDate": "2019-09-21T23:03:13Z",
"UserId": "AIDA123456789EXAMPLE",
"Arn": "arn:aws:iam::123456789012:user/Paulo"
}
}
```
For more information, see [Managing IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [GetUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-user.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// GetUser gets data about a user.
func (wrapper UserWrapper) GetUser(ctx context.Context, userName string) (*types.User, error) {
var user *types.User
result, err := wrapper.IamClient.GetUser(ctx, &iam.GetUserInput{
UserName: aws.String(userName),
})
if err != nil {
var apiError smithy.APIError
if errors.As(err, &apiError) {
switch apiError.(type) {
case *types.NoSuchEntityException:
log.Printf("User %v does not exist.\n", userName)
err = nil
default:
log.Printf("Couldn't get user %v. Here's why: %v\n", userName, err)
}
}
} else {
user = result.User
}
return user, err
}
```
+ For API details, see [GetUser](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.GetUser) in *AWS SDK for Go API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves details about the user named `David`.**
```
Get-IAMUser -UserName David
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE1
UserName : David
```
**Example 2: This example retrieves details about the currently signed-in IAM user.**
```
Get-IAMUser
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 10/16/2014 9:03:09 AM
PasswordLastUsed : 3/4/2015 12:12:33 PM
Path : /
UserId : 7K3GJEANSKZF2EXAMPLE2
UserName : Bob
```
+ For API details, see [GetUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves details about the user named `David`.**
```
Get-IAMUser -UserName David
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE1
UserName : David
```
**Example 2: This example retrieves details about the currently signed-in IAM user.**
```
Get-IAMUser
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 10/16/2014 9:03:09 AM
PasswordLastUsed : 3/4/2015 12:12:33 PM
Path : /
UserId : 7K3GJEANSKZF2EXAMPLE2
UserName : Bob
```
+ For API details, see [GetUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Retrieves a user's details
#
# @param user_name [String] The name of the user to retrieve
# @return [Aws::IAM::Types::User, nil] The user object if found, or nil if an error occurred
def get_user(user_name)
response = @iam_client.get_user(user_name: user_name)
response.user
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("User '#{user_name}' not found.")
nil
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error retrieving user '#{user_name}': #{e.message}")
nil
end
```
+ For API details, see [GetUser](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/GetUser) in *AWS SDK for Ruby API Reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func getUser(name: String? = nil) async throws -> IAMClientTypes.User {
let input = GetUserInput(
userName: name
)
do {
let output = try await iamClient.getUser(input: input)
guard let user = output.user else {
throw ServiceHandlerError.noSuchUser
}
return user
} catch {
print("ERROR: getUser:", dump(error))
throw error
}
}
```
+ For API details, see [GetUser](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/getuser(input:)) in *AWS SDK for Swift API reference*.
------
# Use `GetUserPolicy` with a CLI
The following code examples show how to use `GetUserPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To list policy details for an IAM user**
The following `get-user-policy` command lists the details of the specified policy that is attached to the IAM user named `Bob`.
```
aws iam get-user-policy \
--user-name Bob \
--policy-name ExamplePolicy
```
Output:
```
{
"UserName": "Bob",
"PolicyName": "ExamplePolicy",
"PolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Action": "*",
"Resource": "*",
"Effect": "Allow"
}
]
}
}
```
To get a list of policies for an IAM user, use the `list-user-policies` command.
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [GetUserPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/get-user-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves the details of the inline policy named `Davids_IAM_Admin_Policy` that is embedded in the IAM user named `David`. The policy document is URL encoded.**
```
$results = Get-IAMUserPolicy -PolicyName Davids_IAM_Admin_Policy -UserName David
$results
```
**Output:**
```
PolicyDocument PolicyName UserName
-------------- ---------- --------
%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%... Davids_IAM_Admin_Policy David
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetUser",
"iam:ListUsers"
],
"Resource": [
"arn:aws:iam::111122223333:user/*"
]
}
]
}
```
+ For API details, see [GetUserPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves the details of the inline policy named `Davids_IAM_Admin_Policy` that is embedded in the IAM user named `David`. The policy document is URL encoded.**
```
$results = Get-IAMUserPolicy -PolicyName Davids_IAM_Admin_Policy -UserName David
$results
```
**Output:**
```
PolicyDocument PolicyName UserName
-------------- ---------- --------
%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%... Davids_IAM_Admin_Policy David
[System.Reflection.Assembly]::LoadWithPartialName("System.Web.HttpUtility")
[System.Web.HttpUtility]::UrlDecode($results.PolicyDocument)
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:GetUser",
"iam:ListUsers"
],
"Resource": [
"arn:aws:iam::111122223333:user/*"
]
}
]
}
```
+ For API details, see [GetUserPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListAccessKeys` with an AWS SDK or CLI
The following code examples show how to use `ListAccessKeys`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_list_access_keys
#
# This function lists the access keys for the specified user.
#
# Parameters:
# -u user_name -- The name of the IAM user.
#
# Returns:
# access_key_ids
# And:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_list_access_keys() {
# bashsupport disable=BP5008
function usage() {
echo "function iam_list_access_keys"
echo "Lists the AWS Identity and Access Management (IAM) access key IDs for the specified user."
echo " -u user_name The name of the IAM user."
echo ""
}
local user_name response
local option OPTARG # Required to use getopts command in a function.
# Retrieve the calling parameters.
while getopts "u:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
response=$(aws iam list-access-keys \
--user-name "$user_name" \
--output text \
--query 'AccessKeyMetadata[].AccessKeyId')
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports list-access-keys operation failed.$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/ListAccessKeys) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::listAccessKeys(const Aws::String &userName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListAccessKeysRequest request;
request.SetUserName(userName);
bool done = false;
bool header = false;
while (!done) {
auto outcome = iam.ListAccessKeys(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to list access keys for user " << userName
<< ": " << outcome.GetError().GetMessage() << std::endl;
return false;
}
if (!header) {
std::cout << std::left << std::setw(32) << "UserName" <<
std::setw(30) << "KeyID" << std::setw(20) << "Status" <<
std::setw(20) << "CreateDate" << std::endl;
header = true;
}
const auto &keys = outcome.GetResult().GetAccessKeyMetadata();
const Aws::String DATE_FORMAT = "%Y-%m-%d";
for (const auto &key: keys) {
Aws::String statusString =
Aws::IAM::Model::StatusTypeMapper::GetNameForStatusType(
key.GetStatus());
std::cout << std::left << std::setw(32) << key.GetUserName() <<
std::setw(30) << key.GetAccessKeyId() << std::setw(20) <<
statusString << std::setw(20) <<
key.GetCreateDate().ToGmtString(DATE_FORMAT.c_str()) << std::endl;
}
if (outcome.GetResult().GetIsTruncated()) {
request.SetMarker(outcome.GetResult().GetMarker());
}
else {
done = true;
}
}
return true;
}
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/ListAccessKeys) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list the access key IDs for an IAM user**
The following `list-access-keys` command lists the access keys IDs for the IAM user named `Bob`.
```
aws iam list-access-keys \
--user-name Bob
```
Output:
```
{
"AccessKeyMetadata": [
{
"UserName": "Bob",
"Status": "Active",
"CreateDate": "2013-06-04T18:17:34Z",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
},
{
"UserName": "Bob",
"Status": "Inactive",
"CreateDate": "2013-06-06T20:42:26Z",
"AccessKeyId": "AKIAI44QH8DHBEXAMPLE"
}
]
}
```
You cannot list the secret access keys for IAM users. If the secret access keys are lost, you must create new access keys using the `create-access-keys` command.
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *AWS IAM User Guide*.
+ For API details, see [ListAccessKeys](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-access-keys.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// ListAccessKeys lists the access keys for the specified user.
func (wrapper UserWrapper) ListAccessKeys(ctx context.Context, userName string) ([]types.AccessKeyMetadata, error) {
var keys []types.AccessKeyMetadata
result, err := wrapper.IamClient.ListAccessKeys(ctx, &iam.ListAccessKeysInput{
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't list access keys for user %v. Here's why: %v\n", userName, err)
} else {
keys = result.AccessKeyMetadata
}
return keys, err
}
```
+ For API details, see [ListAccessKeys](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListAccessKeys) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.AccessKeyMetadata;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.ListAccessKeysRequest;
import software.amazon.awssdk.services.iam.model.ListAccessKeysResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class ListAccessKeys {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
userName - The name of the user for which access keys are retrieved.\s
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String userName = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
listKeys(iam, userName);
System.out.println("Done");
iam.close();
}
public static void listKeys(IamClient iam, String userName) {
try {
boolean done = false;
String newMarker = null;
while (!done) {
ListAccessKeysResponse response;
if (newMarker == null) {
ListAccessKeysRequest request = ListAccessKeysRequest.builder()
.userName(userName)
.build();
response = iam.listAccessKeys(request);
} else {
ListAccessKeysRequest request = ListAccessKeysRequest.builder()
.userName(userName)
.marker(newMarker)
.build();
response = iam.listAccessKeys(request);
}
for (AccessKeyMetadata metadata : response.accessKeyMetadata()) {
System.out.format("Retrieved access key %s", metadata.accessKeyId());
}
if (!response.isTruncated()) {
done = true;
} else {
newMarker = response.marker();
}
}
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/ListAccessKeys) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the access keys.
```
import { ListAccessKeysCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*
* @param {string} userName
*/
export async function* listAccessKeys(userName) {
const command = new ListAccessKeysCommand({
MaxItems: 5,
UserName: userName,
});
/**
* @type {import("@aws-sdk/client-iam").ListAccessKeysCommandOutput | undefined}
*/
let response = await client.send(command);
while (response?.AccessKeyMetadata?.length) {
for (const key of response.AccessKeyMetadata) {
yield key;
}
if (response.IsTruncated) {
response = await client.send(
new ListAccessKeysCommand({
Marker: response.Marker,
}),
);
} else {
break;
}
}
}
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-listing).
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListAccessKeysCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
MaxItems: 5,
UserName: "IAM_USER_NAME",
};
iam.listAccessKeys(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iiam-examples-managing-access-keys-listing).
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/ListAccessKeys) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun listKeys(userNameVal: String?) {
val request =
ListAccessKeysRequest {
userName = userNameVal
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.listAccessKeys(request)
response.accessKeyMetadata?.forEach { md ->
println("Retrieved access key ${md.accessKeyId}")
}
}
}
```
+ For API details, see [ListAccessKeys](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command lists the access keys for the IAM user named `Bob`. Note that you cannot list the secret access keys for IAM users. If the secret access keys are lost, you must create new access keys with the `New-IAMAccessKey` cmdlet.**
```
Get-IAMAccessKey -UserName "Bob"
```
**Output:**
```
AccessKeyId CreateDate Status UserName
----------- ---------- ------ --------
AKIAIOSFODNN7EXAMPLE 12/3/2014 10:53:41 AM Active Bob
AKIAI44QH8DHBEXAMPLE 6/6/2013 8:42:26 PM Inactive Bob
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command lists the access keys for the IAM user named `Bob`. Note that you cannot list the secret access keys for IAM users. If the secret access keys are lost, you must create new access keys with the `New-IAMAccessKey` cmdlet.**
```
Get-IAMAccessKey -UserName "Bob"
```
**Output:**
```
AccessKeyId CreateDate Status UserName
----------- ---------- ------ --------
AKIAIOSFODNN7EXAMPLE 12/3/2014 10:53:41 AM Active Bob
AKIAI44QH8DHBEXAMPLE 6/6/2013 8:42:26 PM Inactive Bob
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_keys(user_name):
"""
Lists the keys owned by the specified user.
:param user_name: The name of the user.
:return: The list of keys owned by the user.
"""
try:
keys = list(iam.User(user_name).access_keys.all())
logger.info("Got %s access keys for %s.", len(keys), user_name)
except ClientError:
logger.exception("Couldn't get access keys for %s.", user_name)
raise
else:
return keys
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListAccessKeys) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, deactivates, and deletes access keys.
```
# Manages access keys for IAM users
class AccessKeyManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'AccessKeyManager'
end
# Lists access keys for a user
#
# @param user_name [String] The name of the user.
def list_access_keys(user_name)
response = @iam_client.list_access_keys(user_name: user_name)
if response.access_key_metadata.empty?
@logger.info("No access keys found for user '#{user_name}'.")
else
response.access_key_metadata.map(&:access_key_id)
end
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Error listing access keys: cannot find user '#{user_name}'.")
[]
rescue StandardError => e
@logger.error("Error listing access keys: #{e.message}")
[]
end
# Creates an access key for a user
#
# @param user_name [String] The name of the user.
# @return [Boolean]
def create_access_key(user_name)
response = @iam_client.create_access_key(user_name: user_name)
access_key = response.access_key
@logger.info("Access key created for user '#{user_name}': #{access_key.access_key_id}")
access_key
rescue Aws::IAM::Errors::LimitExceeded
@logger.error('Error creating access key: limit exceeded. Cannot create more.')
nil
rescue StandardError => e
@logger.error("Error creating access key: #{e.message}")
nil
end
# Deactivates an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def deactivate_access_key(user_name, access_key_id)
@iam_client.update_access_key(
user_name: user_name,
access_key_id: access_key_id,
status: 'Inactive'
)
true
rescue StandardError => e
@logger.error("Error deactivating access key: #{e.message}")
false
end
# Deletes an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def delete_access_key(user_name, access_key_id)
@iam_client.delete_access_key(
user_name: user_name,
access_key_id: access_key_id
)
true
rescue StandardError => e
@logger.error("Error deleting access key: #{e.message}")
false
end
end
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListAccessKeys) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listaccesskeys(
iv_username = iv_user_name ).
MESSAGE 'Retrieved access key list.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListAccessKeys](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `ListAccountAliases` with an AWS SDK or CLI
The following code examples show how to use `ListAccountAliases`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage your account](iam_example_iam_Scenario_AccountManagement_section.md)
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool
AwsDoc::IAM::listAccountAliases(const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListAccountAliasesRequest request;
bool done = false;
bool header = false;
while (!done) {
auto outcome = iam.ListAccountAliases(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to list account aliases: " <<
outcome.GetError().GetMessage() << std::endl;
return false;
}
const auto &aliases = outcome.GetResult().GetAccountAliases();
if (!header) {
if (aliases.size() == 0) {
std::cout << "Account has no aliases" << std::endl;
break;
}
std::cout << std::left << std::setw(32) << "Alias" << std::endl;
header = true;
}
for (const auto &alias: aliases) {
std::cout << std::left << std::setw(32) << alias << std::endl;
}
if (outcome.GetResult().GetIsTruncated()) {
request.SetMarker(outcome.GetResult().GetMarker());
}
else {
done = true;
}
}
return true;
}
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/ListAccountAliases) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list account aliases**
The following `list-account-aliases` command lists the aliases for the current account.
```
aws iam list-account-aliases
```
Output:
```
{
"AccountAliases": [
"mycompany"
]
}
```
For more information, see [Your AWS account ID and its alias](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html) in the *AWS IAM User Guide*.
+ For API details, see [ListAccountAliases](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-account-aliases.html) in *AWS CLI Command Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.ListAccountAliasesResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class ListAccountAliases {
public static void main(String[] args) {
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
listAliases(iam);
System.out.println("Done");
iam.close();
}
public static void listAliases(IamClient iam) {
try {
ListAccountAliasesResponse response = iam.listAccountAliases();
for (String alias : response.accountAliases()) {
System.out.printf("Retrieved account alias %s", alias);
}
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/ListAccountAliases) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the account aliases.
```
import { ListAccountAliasesCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*/
export async function* listAccountAliases() {
const command = new ListAccountAliasesCommand({ MaxItems: 5 });
let response = await client.send(command);
while (response.AccountAliases?.length) {
for (const alias of response.AccountAliases) {
yield alias;
}
if (response.IsTruncated) {
response = await client.send(
new ListAccountAliasesCommand({
Marker: response.Marker,
MaxItems: 5,
}),
);
} else {
break;
}
}
}
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-listing).
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListAccountAliasesCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.listAccountAliases({ MaxItems: 10 }, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-account-aliases.html#iam-examples-account-aliases-listing).
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/ListAccountAliases) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun listAliases() {
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.listAccountAliases(ListAccountAliasesRequest {})
response.accountAliases?.forEach { alias ->
println("Retrieved account alias $alias")
}
}
}
```
+ For API details, see [ListAccountAliases](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command returns the account alias for the AWS account.**
```
Get-IAMAccountAlias
```
**Output:**
```
ExampleCo
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command returns the account alias for the AWS account.**
```
Get-IAMAccountAlias
```
**Output:**
```
ExampleCo
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_aliases():
"""
Gets the list of aliases for the current account. An account has at most one alias.
:return: The list of aliases for the account.
"""
try:
response = iam.meta.client.list_account_aliases()
aliases = response["AccountAliases"]
if len(aliases) > 0:
logger.info("Got aliases for your account: %s.", ",".join(aliases))
else:
logger.info("Got no aliases for your account.")
except ClientError:
logger.exception("Couldn't list aliases for your account.")
raise
else:
return response["AccountAliases"]
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListAccountAliases) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, create, and delete account aliases.
```
class IAMAliasManager
# Initializes the IAM client and logger
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client.
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
end
# Lists available AWS account aliases.
def list_aliases
response = @iam_client.list_account_aliases
if response.account_aliases.count.positive?
@logger.info('Account aliases are:')
response.account_aliases.each { |account_alias| @logger.info(" #{account_alias}") }
else
@logger.info('No account aliases found.')
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing account aliases: #{e.message}")
end
# Creates an AWS account alias.
#
# @param account_alias [String] The name of the account alias to create.
# @return [Boolean] true if the account alias was created; otherwise, false.
def create_account_alias(account_alias)
@iam_client.create_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating account alias: #{e.message}")
false
end
# Deletes an AWS account alias.
#
# @param account_alias [String] The name of the account alias to delete.
# @return [Boolean] true if the account alias was deleted; otherwise, false.
def delete_account_alias(account_alias)
@iam_client.delete_account_alias(account_alias: account_alias)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting account alias: #{e.message}")
false
end
end
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListAccountAliases) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listaccountaliases( ).
MESSAGE 'Retrieved account alias list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing account aliases.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListAccountAliases](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `ListAttachedGroupPolicies` with a CLI
The following code examples show how to use `ListAttachedGroupPolicies`.
------
#### [ CLI ]
**AWS CLI**
**To list all managed policies that are attached to the specified group**
This example returns the names and ARNs of the managed policies that are attached to the IAM group named `Admins` in the AWS account.
```
aws iam list-attached-group-policies \
--group-name Admins
```
Output:
```
{
"AttachedPolicies": [
{
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
},
{
"PolicyName": "SecurityAudit",
"PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
}
],
"IsTruncated": false
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListAttachedGroupPolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-attached-group-policies.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command returns the names and ARNs of the managed policies that are attached to the IAM group named `Admins` in the AWS account. To see the list of inline policies embedded in the group, use the `Get-IAMGroupPolicyList` command.**
```
Get-IAMAttachedGroupPolicyList -GroupName "Admins"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/SecurityAudit SecurityAudit
arn:aws:iam::aws:policy/AdministratorAccess AdministratorAccess
```
+ For API details, see [ListAttachedGroupPolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command returns the names and ARNs of the managed policies that are attached to the IAM group named `Admins` in the AWS account. To see the list of inline policies embedded in the group, use the `Get-IAMGroupPolicyList` command.**
```
Get-IAMAttachedGroupPolicyList -GroupName "Admins"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/SecurityAudit SecurityAudit
arn:aws:iam::aws:policy/AdministratorAccess AdministratorAccess
```
+ For API details, see [ListAttachedGroupPolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListAttachedRolePolicies` with an AWS SDK or CLI
The following code examples show how to use `ListAttachedRolePolicies`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List the IAM role policies that are attached to an IAM role.
///
/// The IAM role to list IAM policies for.
/// A list of the IAM policies attached to the IAM role.
public async Task> ListAttachedRolePoliciesAsync(string roleName)
{
var attachedPolicies = new List();
var attachedRolePoliciesPaginator = _IAMService.Paginators.ListAttachedRolePolicies(new ListAttachedRolePoliciesRequest { RoleName = roleName });
await foreach (var response in attachedRolePoliciesPaginator.Responses)
{
attachedPolicies.AddRange(response.AttachedPolicies);
}
return attachedPolicies;
}
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListAttachedRolePolicies) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list all managed policies that are attached to the specified role**
This command returns the names and ARNs of the managed policies attached to the IAM role named `SecurityAuditRole` in the AWS account.
```
aws iam list-attached-role-policies \
--role-name SecurityAuditRole
```
Output:
```
{
"AttachedPolicies": [
{
"PolicyName": "SecurityAudit",
"PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
}
],
"IsTruncated": false
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListAttachedRolePolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-attached-role-policies.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// ListAttachedRolePolicies lists the policies that are attached to the specified role.
func (wrapper RoleWrapper) ListAttachedRolePolicies(ctx context.Context, roleName string) ([]types.AttachedPolicy, error) {
var policies []types.AttachedPolicy
result, err := wrapper.IamClient.ListAttachedRolePolicies(ctx, &iam.ListAttachedRolePoliciesInput{
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't list attached policies for role %v. Here's why: %v\n", roleName, err)
} else {
policies = result.AttachedPolicies
}
return policies, err
}
```
+ For API details, see [ListAttachedRolePolicies](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListAttachedRolePolicies) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the policies that are attached to a role.
```
import {
ListAttachedRolePoliciesCommand,
IAMClient,
} from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
* @param {string} roleName
*/
export async function* listAttachedRolePolicies(roleName) {
const command = new ListAttachedRolePoliciesCommand({
RoleName: roleName,
});
let response = await client.send(command);
while (response.AttachedPolicies?.length) {
for (const policy of response.AttachedPolicies) {
yield policy;
}
if (response.IsTruncated) {
response = await client.send(
new ListAttachedRolePoliciesCommand({
RoleName: roleName,
Marker: response.Marker,
}),
);
} else {
break;
}
}
}
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListAttachedRolePoliciesCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listAttachedRolePolicies($roleName, $pathPrefix = "", $marker = "", $maxItems = 0)
{
$listAttachRolePoliciesArguments = ['RoleName' => $roleName];
if ($pathPrefix) {
$listAttachRolePoliciesArguments['PathPrefix'] = $pathPrefix;
}
if ($marker) {
$listAttachRolePoliciesArguments['Marker'] = $marker;
}
if ($maxItems) {
$listAttachRolePoliciesArguments['MaxItems'] = $maxItems;
}
return $this->iamClient->listAttachedRolePolicies($listAttachRolePoliciesArguments);
}
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListAttachedRolePolicies) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command returns the names and ARNs of the managed policies attached to the IAM role named `SecurityAuditRole` in the AWS account. To see the list of inline policies that are embedded in the role, use the `Get-IAMRolePolicyList` command.**
```
Get-IAMAttachedRolePolicyList -RoleName "SecurityAuditRole"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/SecurityAudit SecurityAudit
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command returns the names and ARNs of the managed policies attached to the IAM role named `SecurityAuditRole` in the AWS account. To see the list of inline policies that are embedded in the role, use the `Get-IAMRolePolicyList` command.**
```
Get-IAMAttachedRolePolicyList -RoleName "SecurityAuditRole"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/SecurityAudit SecurityAudit
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_attached_policies(role_name):
"""
Lists policies attached to a role.
:param role_name: The name of the role to query.
"""
try:
role = iam.Role(role_name)
for policy in role.attached_policies.all():
logger.info("Got policy %s.", policy.arn)
except ClientError:
logger.exception("Couldn't list attached policies for %s.", role_name)
raise
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListAttachedRolePolicies) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, attaches, and detaches role policies.
```
# Manages policies in AWS Identity and Access Management (IAM)
class RolePolicyManager
# Initialize with an AWS IAM client
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'PolicyManager'
end
# Creates a policy
#
# @param policy_name [String] The name of the policy
# @param policy_document [Hash] The policy document
# @return [String] The policy ARN if successful, otherwise nil
def create_policy(policy_name, policy_document)
response = @iam_client.create_policy(
policy_name: policy_name,
policy_document: policy_document.to_json
)
response.policy.arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating policy: #{e.message}")
nil
end
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
# Attaches a policy to a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_role(role_name, policy_arn)
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to role: #{e.message}")
false
end
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
# Detaches a policy from a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def detach_policy_from_role(role_name, policy_arn)
@iam_client.detach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from role: #{e.message}")
false
end
end
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListAttachedRolePolicies) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_attached_role_policies(
client: &iamClient,
role_name: String,
path_prefix: Option,
marker: Option,
max_items: Option,
) -> Result> {
let response = client
.list_attached_role_policies()
.role_name(role_name)
.set_path_prefix(path_prefix)
.set_marker(marker)
.set_max_items(max_items)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [ListAttachedRolePolicies](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_attached_role_policies) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listattachedrolepolicies(
iv_rolename = iv_role_name ).
MESSAGE 'Retrieved attached policy list for role.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListAttachedRolePolicies](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
/// Returns a list of AWS Identity and Access Management (IAM) policies
/// that are attached to the role.
///
/// - Parameter role: The IAM role to return the policy list for.
///
/// - Returns: An array of `IAMClientTypes.AttachedPolicy` objects
/// describing each managed policy that's attached to the role.
public func listAttachedRolePolicies(role: String) async throws -> [IAMClientTypes.AttachedPolicy] {
var policyList: [IAMClientTypes.AttachedPolicy] = []
// Use "Paginated" to get all the attached role polices.
// This lets the SDK handle the 'isTruncated' in "ListAttachedRolePoliciesOutput".
let input = ListAttachedRolePoliciesInput(
roleName: role
)
let output = client.listAttachedRolePoliciesPaginated(input: input)
do {
for try await page in output {
guard let attachedPolicies = page.attachedPolicies else {
print("Error: no attached policies returned.")
continue
}
for attachedPolicy in attachedPolicies {
policyList.append(attachedPolicy)
}
}
} catch {
print("ERROR: listAttachedRolePolicies:", dump(error))
throw error
}
return policyList
}
```
+ For API details, see [ListAttachedRolePolicies](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listattachedrolepolicies(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListAttachedUserPolicies` with a CLI
The following code examples show how to use `ListAttachedUserPolicies`.
------
#### [ CLI ]
**AWS CLI**
**To list all managed policies that are attached to the specified user**
This command returns the names and ARNs of the managed policies for the IAM user named `Bob` in the AWS account.
```
aws iam list-attached-user-policies \
--user-name Bob
```
Output:
```
{
"AttachedPolicies": [
{
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
},
{
"PolicyName": "SecurityAudit",
"PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
}
],
"IsTruncated": false
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListAttachedUserPolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-attached-user-policies.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This command returns the names and ARNs of the managed policies for the IAM user named `Bob` in the AWS account. To see the list of inline policies that are embedded in the IAM user, use the `Get-IAMUserPolicyList` command.**
```
Get-IAMAttachedUserPolicyList -UserName "Bob"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/TesterPolicy TesterPolicy
```
+ For API details, see [ListAttachedUserPolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This command returns the names and ARNs of the managed policies for the IAM user named `Bob` in the AWS account. To see the list of inline policies that are embedded in the IAM user, use the `Get-IAMUserPolicyList` command.**
```
Get-IAMAttachedUserPolicyList -UserName "Bob"
```
**Output:**
```
PolicyArn PolicyName
--------- ----------
arn:aws:iam::aws:policy/TesterPolicy TesterPolicy
```
+ For API details, see [ListAttachedUserPolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListEntitiesForPolicy` with a CLI
The following code examples show how to use `ListEntitiesForPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To list all users, groups, and roles that the specified managed policy is attached to**
This example returns a list of IAM groups, roles, and users who have the policy `arn:aws:iam::123456789012:policy/TestPolicy` attached.
```
aws iam list-entities-for-policy \
--policy-arn arn:aws:iam::123456789012:policy/TestPolicy
```
Output:
```
{
"PolicyGroups": [
{
"GroupName": "Admins",
"GroupId": "AGPACKCEVSQ6C2EXAMPLE"
}
],
"PolicyUsers": [
{
"UserName": "Alice",
"UserId": "AIDACKCEVSQ6C2EXAMPLE"
}
],
"PolicyRoles": [
{
"RoleName": "DevRole",
"RoleId": "AROADBQP57FF2AEXAMPLE"
}
],
"IsTruncated": false
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListEntitiesForPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-entities-for-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a list of IAM groups, roles, and users who have the policy `arn:aws:iam::123456789012:policy/TestPolicy` attached.**
```
Get-IAMEntitiesForPolicy -PolicyArn "arn:aws:iam::123456789012:policy/TestPolicy"
```
**Output:**
```
IsTruncated : False
Marker :
PolicyGroups : {}
PolicyRoles : {testRole}
PolicyUsers : {Bob, Theresa}
```
+ For API details, see [ListEntitiesForPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a list of IAM groups, roles, and users who have the policy `arn:aws:iam::123456789012:policy/TestPolicy` attached.**
```
Get-IAMEntitiesForPolicy -PolicyArn "arn:aws:iam::123456789012:policy/TestPolicy"
```
**Output:**
```
IsTruncated : False
Marker :
PolicyGroups : {}
PolicyRoles : {testRole}
PolicyUsers : {Bob, Theresa}
```
+ For API details, see [ListEntitiesForPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListGroupPolicies` with a CLI
The following code examples show how to use `ListGroupPolicies`.
------
#### [ CLI ]
**AWS CLI**
**To list all inline policies that are attached to the specified group**
The following `list-group-policies` command lists the names of inline policies that are attached to the IAM group named `Admins` in the current account.
```
aws iam list-group-policies \
--group-name Admins
```
Output:
```
{
"PolicyNames": [
"AdminRoot",
"ExamplePolicy"
]
}
```
For more information, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [ListGroupPolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-group-policies.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a list of the inline policies that are embedded in the group `Testers`. To get the managed policies that are attached to the group, use the command `Get-IAMAttachedGroupPolicyList`.**
```
Get-IAMGroupPolicyList -GroupName Testers
```
**Output:**
```
Deny-Assume-S3-Role-In-Production
PowerUserAccess-Testers
```
+ For API details, see [ListGroupPolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a list of the inline policies that are embedded in the group `Testers`. To get the managed policies that are attached to the group, use the command `Get-IAMAttachedGroupPolicyList`.**
```
Get-IAMGroupPolicyList -GroupName Testers
```
**Output:**
```
Deny-Assume-S3-Role-In-Production
PowerUserAccess-Testers
```
+ For API details, see [ListGroupPolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListGroups` with an AWS SDK or CLI
The following code examples show how to use `ListGroups`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List IAM groups.
///
/// A list of IAM groups.
public async Task> ListGroupsAsync()
{
var groupsPaginator = _IAMService.Paginators.ListGroups(new ListGroupsRequest());
var groups = new List();
await foreach (var response in groupsPaginator.Responses)
{
groups.AddRange(response.Groups);
}
return groups;
}
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListGroups) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list the IAM groups for the current account**
The following `list-groups` command lists the IAM groups in the current account.
```
aws iam list-groups
```
Output:
```
{
"Groups": [
{
"Path": "/",
"CreateDate": "2013-06-04T20:27:27.972Z",
"GroupId": "AIDACKCEVSQ6C2EXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/Admins",
"GroupName": "Admins"
},
{
"Path": "/",
"CreateDate": "2013-04-16T20:30:42Z",
"GroupId": "AIDGPMS9RO4H3FEXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/S3-Admins",
"GroupName": "S3-Admins"
}
]
}
```
For more information, see [Managing IAM user groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [ListGroups](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-groups.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// GroupWrapper encapsulates AWS Identity and Access Management (IAM) group actions
// used in the examples.
// It contains an IAM service client that is used to perform group actions.
type GroupWrapper struct {
IamClient *iam.Client
}
// ListGroups lists up to maxGroups number of groups.
func (wrapper GroupWrapper) ListGroups(ctx context.Context, maxGroups int32) ([]types.Group, error) {
var groups []types.Group
result, err := wrapper.IamClient.ListGroups(ctx, &iam.ListGroupsInput{
MaxItems: aws.Int32(maxGroups),
})
if err != nil {
log.Printf("Couldn't list groups. Here's why: %v\n", err)
} else {
groups = result.Groups
}
return groups, err
}
```
+ For API details, see [ListGroups](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListGroups) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the groups.
```
import { ListGroupsCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*/
export async function* listGroups() {
const command = new ListGroupsCommand({
MaxItems: 10,
});
let response = await client.send(command);
while (response.Groups?.length) {
for (const group of response.Groups) {
yield group;
}
if (response.IsTruncated) {
response = await client.send(
new ListGroupsCommand({
Marker: response.Marker,
MaxItems: 10,
}),
);
} else {
break;
}
}
}
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListGroupsCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listGroups($pathPrefix = "", $marker = "", $maxItems = 0)
{
$listGroupsArguments = [];
if ($pathPrefix) {
$listGroupsArguments["PathPrefix"] = $pathPrefix;
}
if ($marker) {
$listGroupsArguments["Marker"] = $marker;
}
if ($maxItems) {
$listGroupsArguments["MaxItems"] = $maxItems;
}
return $this->iamClient->listGroups($listGroupsArguments);
}
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListGroups) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a collection of all the IAM groups defined in the current AWS account.**
```
Get-IAMGroupList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Administrators
CreateDate : 10/20/2014 10:06:24 AM
GroupId : 6WCH4TRY3KIHIEXAMPLE1
GroupName : Administrators
Path : /
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 12/10/2014 3:38:55 PM
GroupId : ZU2EOWMK6WBZOEXAMPLE2
GroupName : Developers
Path : /
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : RHNZZGQJ7QHMAEXAMPLE3
GroupName : Testers
Path : /
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a collection of all the IAM groups defined in the current AWS account.**
```
Get-IAMGroupList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Administrators
CreateDate : 10/20/2014 10:06:24 AM
GroupId : 6WCH4TRY3KIHIEXAMPLE1
GroupName : Administrators
Path : /
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 12/10/2014 3:38:55 PM
GroupId : ZU2EOWMK6WBZOEXAMPLE2
GroupName : Developers
Path : /
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : RHNZZGQJ7QHMAEXAMPLE3
GroupName : Testers
Path : /
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_groups(count):
"""
Lists the specified number of groups for the account.
:param count: The number of groups to list.
"""
try:
for group in iam.groups.limit(count):
logger.info("Group: %s", group.name)
except ClientError:
logger.exception("Couldn't list groups for the account.")
raise
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListGroups) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# A class to manage IAM operations via the AWS SDK client
class IamGroupManager
# Initializes the IamGroupManager class
# @param iam_client [Aws::IAM::Client] An instance of the IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
end
# Lists up to a specified number of groups for the account.
# @param count [Integer] The maximum number of groups to list.
# @return [Aws::IAM::Client::Response]
def list_groups(count)
response = @iam_client.list_groups(max_items: count)
response.groups.each do |group|
@logger.info("\t#{group.group_name}")
end
response
rescue Aws::Errors::ServiceError => e
@logger.error("Couldn't list groups for the account. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
end
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListGroups) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_groups(
client: &iamClient,
path_prefix: Option,
marker: Option,
max_items: Option,
) -> Result> {
let response = client
.list_groups()
.set_path_prefix(path_prefix)
.set_marker(marker)
.set_max_items(max_items)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [ListGroups](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_groups) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listgroups( ).
MESSAGE 'Retrieved group list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing groups.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListGroups](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func listGroups() async throws -> [String] {
var groupList: [String] = []
// Use "Paginated" to get all the groups.
// This lets the SDK handle the 'isTruncated' property in "ListGroupsOutput".
let input = ListGroupsInput()
let pages = client.listGroupsPaginated(input: input)
do {
for try await page in pages {
guard let groups = page.groups else {
print("Error: no groups returned.")
continue
}
for group in groups {
if let name = group.groupName {
groupList.append(name)
}
}
}
} catch {
print("ERROR: listGroups:", dump(error))
throw error
}
return groupList
}
```
+ For API details, see [ListGroups](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listgroups(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListGroupsForUser` with a CLI
The following code examples show how to use `ListGroupsForUser`.
------
#### [ CLI ]
**AWS CLI**
**To list the groups that an IAM user belongs to**
The following `list-groups-for-user` command displays the groups that the IAM user named `Bob` belongs to.
```
aws iam list-groups-for-user \
--user-name Bob
```
Output:
```
{
"Groups": [
{
"Path": "/",
"CreateDate": "2013-05-06T01:18:08Z",
"GroupId": "AKIAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/Admin",
"GroupName": "Admin"
},
{
"Path": "/",
"CreateDate": "2013-05-06T01:37:28Z",
"GroupId": "AKIAI44QH8DHBEXAMPLE",
"Arn": "arn:aws:iam::123456789012:group/s3-Users",
"GroupName": "s3-Users"
}
]
}
```
For more information, see [Managing IAM user groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [ListGroupsForUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-groups-for-user.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the list of IAM groups that the IAM user `David` belongs to.**
```
Get-IAMGroupForUser -UserName David
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Administrators
CreateDate : 10/20/2014 10:06:24 AM
GroupId : 6WCH4TRY3KIHIEXAMPLE1
GroupName : Administrators
Path : /
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : RHNZZGQJ7QHMAEXAMPLE2
GroupName : Testers
Path : /
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 12/10/2014 3:38:55 PM
GroupId : ZU2EOWMK6WBZOEXAMPLE3
GroupName : Developers
Path : /
```
+ For API details, see [ListGroupsForUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the list of IAM groups that the IAM user `David` belongs to.**
```
Get-IAMGroupForUser -UserName David
```
**Output:**
```
Arn : arn:aws:iam::123456789012:group/Administrators
CreateDate : 10/20/2014 10:06:24 AM
GroupId : 6WCH4TRY3KIHIEXAMPLE1
GroupName : Administrators
Path : /
Arn : arn:aws:iam::123456789012:group/Testers
CreateDate : 12/10/2014 3:39:11 PM
GroupId : RHNZZGQJ7QHMAEXAMPLE2
GroupName : Testers
Path : /
Arn : arn:aws:iam::123456789012:group/Developers
CreateDate : 12/10/2014 3:38:55 PM
GroupId : ZU2EOWMK6WBZOEXAMPLE3
GroupName : Developers
Path : /
```
+ For API details, see [ListGroupsForUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListInstanceProfiles` with a CLI
The following code examples show how to use `ListInstanceProfiles`.
------
#### [ CLI ]
**AWS CLI**
**To lists the instance profiles for the account**
The following `list-instance-profiles` command lists the instance profiles that are associated with the current account.
```
aws iam list-instance-profiles
```
Output:
```
{
"InstanceProfiles": [
{
"Path": "/",
"InstanceProfileName": "example-dev-role",
"InstanceProfileId": "AIPAIXEU4NUHUPEXAMPLE",
"Arn": "arn:aws:iam::123456789012:instance-profile/example-dev-role",
"CreateDate": "2023-09-21T18:17:41+00:00",
"Roles": [
{
"Path": "/",
"RoleName": "example-dev-role",
"RoleId": "AROAJ52OTH4H7LEXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/example-dev-role",
"CreateDate": "2023-09-21T18:17:40+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
]
},
{
"Path": "/",
"InstanceProfileName": "example-s3-role",
"InstanceProfileId": "AIPAJVJVNRIQFREXAMPLE",
"Arn": "arn:aws:iam::123456789012:instance-profile/example-s3-role",
"CreateDate": "2023-09-21T18:18:50+00:00",
"Roles": [
{
"Path": "/",
"RoleName": "example-s3-role",
"RoleId": "AROAINUBC5O7XLEXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/example-s3-role",
"CreateDate": "2023-09-21T18:18:49+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
]
}
]
}
```
For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [ListInstanceProfiles](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-instance-profiles.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a collection of the instance profiles defined in the current AWS account.**
```
Get-IAMInstanceProfileList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [ListInstanceProfiles](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a collection of the instance profiles defined in the current AWS account.**
```
Get-IAMInstanceProfileList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [ListInstanceProfiles](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListInstanceProfilesForRole` with a CLI
The following code examples show how to use `ListInstanceProfilesForRole`.
------
#### [ CLI ]
**AWS CLI**
**To list the instance profiles for an IAM role**
The following `list-instance-profiles-for-role` command lists the instance profiles that are associated with the role `Test-Role`.
```
aws iam list-instance-profiles-for-role \
--role-name Test-Role
```
Output:
```
{
"InstanceProfiles": [
{
"InstanceProfileId": "AIDGPMS9RO4H3FEXAMPLE",
"Roles": [
{
"AssumeRolePolicyDocument": "",
"RoleId": "AIDACKCEVSQ6C2EXAMPLE",
"CreateDate": "2013-06-07T20:42:15Z",
"RoleName": "Test-Role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/Test-Role"
}
],
"CreateDate": "2013-06-07T21:05:24Z",
"InstanceProfileName": "ExampleInstanceProfile",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/ExampleInstanceProfile"
}
]
}
```
For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [ListInstanceProfilesForRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-instance-profiles-for-role.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details of the instance profile associated with the role `ec2instancerole`.**
```
Get-IAMInstanceProfileForRole -RoleName ec2instancerole
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [ListInstanceProfilesForRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details of the instance profile associated with the role `ec2instancerole`.**
```
Get-IAMInstanceProfileForRole -RoleName ec2instancerole
```
**Output:**
```
Arn : arn:aws:iam::123456789012:instance-profile/ec2instancerole
CreateDate : 2/17/2015 2:49:04 PM
InstanceProfileId : HH36PTZQJUR32EXAMPLE1
InstanceProfileName : ec2instancerole
Path : /
Roles : {ec2instancerole}
```
+ For API details, see [ListInstanceProfilesForRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListMfaDevices` with a CLI
The following code examples show how to use `ListMfaDevices`.
------
#### [ CLI ]
**AWS CLI**
**To list all MFA devices for a specified user**
This example returns details about the MFA device assigned to the IAM user `Bob`.
```
aws iam list-mfa-devices \
--user-name Bob
```
Output:
```
{
"MFADevices": [
{
"UserName": "Bob",
"SerialNumber": "arn:aws:iam::123456789012:mfa/Bob",
"EnableDate": "2019-10-28T20:37:09+00:00"
},
{
"UserName": "Bob",
"SerialNumber": "GAKT12345678",
"EnableDate": "2023-02-18T21:44:42+00:00"
},
{
"UserName": "Bob",
"SerialNumber": "arn:aws:iam::123456789012:u2f/user/Bob/fidosecuritykey1-7XNL7NFNLZ123456789EXAMPLE",
"EnableDate": "2023-09-19T02:25:35+00:00"
},
{
"UserName": "Bob",
"SerialNumber": "arn:aws:iam::123456789012:u2f/user/Bob/fidosecuritykey2-VDRQTDBBN5123456789EXAMPLE",
"EnableDate": "2023-09-19T01:49:18+00:00"
}
]
}
```
For more information, see [Using multi-factor authentication (MFA) in AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) in the *AWS IAM User Guide*.
+ For API details, see [ListMfaDevices](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-mfa-devices.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns details about the MFA device assigned to the IAM user `David`. In this example you can tell that it is a virtual device because the `SerialNumber` is an ARN instead of a physical device's actual serial number.**
```
Get-IAMMFADevice -UserName David
```
**Output:**
```
EnableDate SerialNumber UserName
---------- ------------ --------
4/8/2015 9:41:10 AM arn:aws:iam::123456789012:mfa/David David
```
+ For API details, see [ListMfaDevices](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns details about the MFA device assigned to the IAM user `David`. In this example you can tell that it is a virtual device because the `SerialNumber` is an ARN instead of a physical device's actual serial number.**
```
Get-IAMMFADevice -UserName David
```
**Output:**
```
EnableDate SerialNumber UserName
---------- ------------ --------
4/8/2015 9:41:10 AM arn:aws:iam::123456789012:mfa/David David
```
+ For API details, see [ListMfaDevices](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListOpenIdConnectProviders` with a CLI
The following code examples show how to use `ListOpenIdConnectProviders`.
------
#### [ CLI ]
**AWS CLI**
**To list information about the OpenID Connect providers in the AWS account**
This example returns a list of ARNS of all the OpenID Connect providers that are defined in the current AWS account.
```
aws iam list-open-id-connect-providers
```
Output:
```
{
"OpenIDConnectProviderList": [
{
"Arn": "arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com"
}
]
}
```
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [ListOpenIdConnectProviders](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-open-id-connect-providers.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a list of ARNS of all the OpenID Connect providers that are defined in the current AWS account.**
```
Get-IAMOpenIDConnectProviderList
```
**Output:**
```
Arn
---
arn:aws:iam::123456789012:oidc-provider/server.example.com
arn:aws:iam::123456789012:oidc-provider/another.provider.com
```
+ For API details, see [ListOpenIdConnectProviders](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a list of ARNS of all the OpenID Connect providers that are defined in the current AWS account.**
```
Get-IAMOpenIDConnectProviderList
```
**Output:**
```
Arn
---
arn:aws:iam::123456789012:oidc-provider/server.example.com
arn:aws:iam::123456789012:oidc-provider/another.provider.com
```
+ For API details, see [ListOpenIdConnectProviders](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListPolicies` with an AWS SDK or CLI
The following code examples show how to use `ListPolicies`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List IAM policies.
///
/// A list of the IAM policies.
public async Task> ListPoliciesAsync()
{
var listPoliciesPaginator = _IAMService.Paginators.ListPolicies(new ListPoliciesRequest());
var policies = new List();
await foreach (var response in listPoliciesPaginator.Responses)
{
policies.AddRange(response.Policies);
}
return policies;
}
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListPolicies) in *AWS SDK for .NET API Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::listPolicies(const Aws::Client::ClientConfiguration &clientConfig) {
const Aws::String DATE_FORMAT("%Y-%m-%d");
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListPoliciesRequest request;
bool done = false;
bool header = false;
while (!done) {
auto outcome = iam.ListPolicies(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to list iam policies: " <<
outcome.GetError().GetMessage() << std::endl;
return false;
}
if (!header) {
std::cout << std::left << std::setw(55) << "Name" <<
std::setw(30) << "ID" << std::setw(80) << "Arn" <<
std::setw(64) << "Description" << std::setw(12) <<
"CreateDate" << std::endl;
header = true;
}
const auto &policies = outcome.GetResult().GetPolicies();
for (const auto &policy: policies) {
std::cout << std::left << std::setw(55) <<
policy.GetPolicyName() << std::setw(30) <<
policy.GetPolicyId() << std::setw(80) << policy.GetArn() <<
std::setw(64) << policy.GetDescription() << std::setw(12) <<
policy.GetCreateDate().ToGmtString(DATE_FORMAT.c_str()) <<
std::endl;
}
if (outcome.GetResult().GetIsTruncated()) {
request.SetMarker(outcome.GetResult().GetMarker());
}
else {
done = true;
}
}
return true;
}
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/ListPolicies) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list managed policies that are available to your AWS account**
This example returns a collection of the first two managed policies available in the current AWS account.
```
aws iam list-policies \
--max-items 3
```
Output:
```
{
"Policies": [
{
"PolicyName": "AWSCloudTrailAccessPolicy",
"PolicyId": "ANPAXQE2B5PJ7YEXAMPLE",
"Arn": "arn:aws:iam::123456789012:policy/AWSCloudTrailAccessPolicy",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2019-09-04T17:43:42+00:00",
"UpdateDate": "2019-09-04T17:43:42+00:00"
},
{
"PolicyName": "AdministratorAccess",
"PolicyId": "ANPAIWMBCKSKIEE64ZLYK",
"Arn": "arn:aws:iam::aws:policy/AdministratorAccess",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 6,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2015-02-06T18:39:46+00:00",
"UpdateDate": "2015-02-06T18:39:46+00:00"
},
{
"PolicyName": "PowerUserAccess",
"PolicyId": "ANPAJYRXTHIB4FOVS3ZXS",
"Arn": "arn:aws:iam::aws:policy/PowerUserAccess",
"Path": "/",
"DefaultVersionId": "v5",
"AttachmentCount": 1,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2015-02-06T18:39:47+00:00",
"UpdateDate": "2023-07-06T22:04:00+00:00"
}
],
"NextToken": "EXAMPLErZXIiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiA4fQ=="
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListPolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policies.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// PolicyWrapper encapsulates AWS Identity and Access Management (IAM) policy actions
// used in the examples.
// It contains an IAM service client that is used to perform policy actions.
type PolicyWrapper struct {
IamClient *iam.Client
}
// ListPolicies gets up to maxPolicies policies.
func (wrapper PolicyWrapper) ListPolicies(ctx context.Context, maxPolicies int32) ([]types.Policy, error) {
var policies []types.Policy
result, err := wrapper.IamClient.ListPolicies(ctx, &iam.ListPoliciesInput{
MaxItems: aws.Int32(maxPolicies),
})
if err != nil {
log.Printf("Couldn't list policies. Here's why: %v\n", err)
} else {
policies = result.Policies
}
return policies, err
}
```
+ For API details, see [ListPolicies](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListPolicies) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the policies.
```
import { ListPoliciesCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*
*/
export async function* listPolicies() {
const command = new ListPoliciesCommand({
MaxItems: 10,
OnlyAttached: false,
// List only the customer managed policies in your Amazon Web Services account.
Scope: "Local",
});
let response = await client.send(command);
while (response.Policies?.length) {
for (const policy of response.Policies) {
yield policy;
}
if (response.IsTruncated) {
response = await client.send(
new ListPoliciesCommand({
Marker: response.Marker,
MaxItems: 10,
OnlyAttached: false,
Scope: "Local",
}),
);
} else {
break;
}
}
}
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListPoliciesCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listPolicies($pathPrefix = "", $marker = "", $maxItems = 0)
{
$listPoliciesArguments = [];
if ($pathPrefix) {
$listPoliciesArguments["PathPrefix"] = $pathPrefix;
}
if ($marker) {
$listPoliciesArguments["Marker"] = $marker;
}
if ($maxItems) {
$listPoliciesArguments["MaxItems"] = $maxItems;
}
return $this->iamClient->listPolicies($listPoliciesArguments);
}
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListPolicies) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns a collection of the first three managed policies available in the current AWS account. Because `-scope` is not specified, it defaults to `all` and includes both AWS managed and customer managed policies.**
```
Get-IAMPolicyList -MaxItem 3
```
**Output:**
```
Arn : arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:08 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : Z27SI6FQMGNQ2EXAMPLE1
PolicyName : AWSDirectConnectReadOnlyAccess
UpdateDate : 2/6/2015 10:40:08 AM
Arn : arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:27 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : NJKMU274MET4EEXAMPLE2
PolicyName : AmazonGlacierReadOnlyAccess
UpdateDate : 2/6/2015 10:40:27 AM
Arn : arn:aws:iam::aws:policy/AWSMarketplaceFullAccess
AttachmentCount : 0
CreateDate : 2/11/2015 9:21:45 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : 5ULJSO2FYVPYGEXAMPLE3
PolicyName : AWSMarketplaceFullAccess
UpdateDate : 2/11/2015 9:21:45 AM
```
**Example 2: This example returns a collection of the first two customer managed policies available in current AWS account. It uses `-Scope local` to limit the output to only customer managed policies. **
```
Get-IAMPolicyList -Scope local -MaxItem 2
```
**Output:**
```
Arn : arn:aws:iam::123456789012:policy/MyLocalPolicy
AttachmentCount : 0
CreateDate : 2/12/2015 9:39:09 AM
DefaultVersionId : v2
Description :
IsAttachable : True
Path : /
PolicyId : SQVCBLC4VAOUCEXAMPLE4
PolicyName : MyLocalPolicy
UpdateDate : 2/12/2015 9:39:53 AM
Arn : arn:aws:iam::123456789012:policy/policyforec2instancerole
AttachmentCount : 1
CreateDate : 2/17/2015 2:51:38 PM
DefaultVersionId : v11
Description :
IsAttachable : True
Path : /
PolicyId : X5JPBLJH2Z2SOEXAMPLE5
PolicyName : policyforec2instancerole
UpdateDate : 2/18/2015 8:52:31 AM
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns a collection of the first three managed policies available in the current AWS account. Because `-scope` is not specified, it defaults to `all` and includes both AWS managed and customer managed policies.**
```
Get-IAMPolicyList -MaxItem 3
```
**Output:**
```
Arn : arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:08 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : Z27SI6FQMGNQ2EXAMPLE1
PolicyName : AWSDirectConnectReadOnlyAccess
UpdateDate : 2/6/2015 10:40:08 AM
Arn : arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess
AttachmentCount : 0
CreateDate : 2/6/2015 10:40:27 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : NJKMU274MET4EEXAMPLE2
PolicyName : AmazonGlacierReadOnlyAccess
UpdateDate : 2/6/2015 10:40:27 AM
Arn : arn:aws:iam::aws:policy/AWSMarketplaceFullAccess
AttachmentCount : 0
CreateDate : 2/11/2015 9:21:45 AM
DefaultVersionId : v1
Description :
IsAttachable : True
Path : /
PolicyId : 5ULJSO2FYVPYGEXAMPLE3
PolicyName : AWSMarketplaceFullAccess
UpdateDate : 2/11/2015 9:21:45 AM
```
**Example 2: This example returns a collection of the first two customer managed policies available in current AWS account. It uses `-Scope local` to limit the output to only customer managed policies. **
```
Get-IAMPolicyList -Scope local -MaxItem 2
```
**Output:**
```
Arn : arn:aws:iam::123456789012:policy/MyLocalPolicy
AttachmentCount : 0
CreateDate : 2/12/2015 9:39:09 AM
DefaultVersionId : v2
Description :
IsAttachable : True
Path : /
PolicyId : SQVCBLC4VAOUCEXAMPLE4
PolicyName : MyLocalPolicy
UpdateDate : 2/12/2015 9:39:53 AM
Arn : arn:aws:iam::123456789012:policy/policyforec2instancerole
AttachmentCount : 1
CreateDate : 2/17/2015 2:51:38 PM
DefaultVersionId : v11
Description :
IsAttachable : True
Path : /
PolicyId : X5JPBLJH2Z2SOEXAMPLE5
PolicyName : policyforec2instancerole
UpdateDate : 2/18/2015 8:52:31 AM
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_policies(scope):
"""
Lists the policies in the current account.
:param scope: Limits the kinds of policies that are returned. For example,
'Local' specifies that only locally managed policies are returned.
:return: The list of policies.
"""
try:
policies = list(iam.policies.filter(Scope=scope))
logger.info("Got %s policies in scope '%s'.", len(policies), scope)
except ClientError:
logger.exception("Couldn't get policies for scope '%s'.", scope)
raise
else:
return policies
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListPolicies) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, attaches, and detaches role policies.
```
# Manages policies in AWS Identity and Access Management (IAM)
class RolePolicyManager
# Initialize with an AWS IAM client
#
# @param iam_client [Aws::IAM::Client] An initialized IAM client
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'PolicyManager'
end
# Creates a policy
#
# @param policy_name [String] The name of the policy
# @param policy_document [Hash] The policy document
# @return [String] The policy ARN if successful, otherwise nil
def create_policy(policy_name, policy_document)
response = @iam_client.create_policy(
policy_name: policy_name,
policy_document: policy_document.to_json
)
response.policy.arn
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error creating policy: #{e.message}")
nil
end
# Fetches an IAM policy by its ARN
# @param policy_arn [String] the ARN of the IAM policy to retrieve
# @return [Aws::IAM::Types::GetPolicyResponse] the policy object if found
def get_policy(policy_arn)
response = @iam_client.get_policy(policy_arn: policy_arn)
policy = response.policy
@logger.info("Got policy '#{policy.policy_name}'. Its ID is: #{policy.policy_id}.")
policy
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Couldn't get policy '#{policy_arn}'. The policy does not exist.")
raise
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't get policy '#{policy_arn}'. Here's why: #{e.code}: #{e.message}")
raise
end
# Attaches a policy to a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def attach_policy_to_role(role_name, policy_arn)
@iam_client.attach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error attaching policy to role: #{e.message}")
false
end
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
# Detaches a policy from a role
#
# @param role_name [String] The name of the role
# @param policy_arn [String] The policy ARN
# @return [Boolean] true if successful, false otherwise
def detach_policy_from_role(role_name, policy_arn)
@iam_client.detach_role_policy(
role_name: role_name,
policy_arn: policy_arn
)
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error detaching policy from role: #{e.message}")
false
end
end
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListPolicies) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_policies(
client: iamClient,
path_prefix: String,
) -> Result, SdkError> {
let list_policies = client
.list_policies()
.path_prefix(path_prefix)
.scope(PolicyScopeType::Local)
.into_paginator()
.items()
.send()
.try_collect()
.await?;
let policy_names = list_policies
.into_iter()
.map(|p| {
let name = p
.policy_name
.unwrap_or_else(|| "Missing Policy Name".to_string());
println!("{}", name);
name
})
.collect();
Ok(policy_names)
}
```
+ For API details, see [ListPolicies](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_policies) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listpolicies( iv_scope = iv_scope ).
MESSAGE 'Retrieved policy list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing policies.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListPolicies](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func listPolicies() async throws -> [MyPolicyRecord] {
var policyList: [MyPolicyRecord] = []
// Use "Paginated" to get all the policies.
// This lets the SDK handle the 'isTruncated' in "ListPoliciesOutput".
let input = ListPoliciesInput()
let output = client.listPoliciesPaginated(input: input)
do {
for try await page in output {
guard let policies = page.policies else {
print("Error: no policies returned.")
continue
}
for policy in policies {
guard let name = policy.policyName,
let id = policy.policyId,
let arn = policy.arn
else {
throw ServiceHandlerError.noSuchPolicy
}
policyList.append(MyPolicyRecord(name: name, id: id, arn: arn))
}
}
} catch {
print("ERROR: listPolicies:", dump(error))
throw error
}
return policyList
}
```
+ For API details, see [ListPolicies](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listpolicies(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListPolicyVersions` with an AWS SDK or CLI
The following code examples show how to use `ListPolicyVersions`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Roll back a policy version](iam_example_iam_Scenario_RollbackPolicyVersion_section.md)
------
#### [ CLI ]
**AWS CLI**
**To list information about the versions of the specified managed policy**
This example returns the list of available versions of the policy whose ARN is `arn:aws:iam::123456789012:policy/MySamplePolicy`.
```
aws iam list-policy-versions \
--policy-arn arn:aws:iam::123456789012:policy/MySamplePolicy
```
Output:
```
{
"IsTruncated": false,
"Versions": [
{
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2015-06-02T23:19:44Z"
},
{
"VersionId": "v1",
"IsDefaultVersion": false,
"CreateDate": "2015-06-02T22:30:47Z"
}
]
}
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [ListPolicyVersions](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policy-versions.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the list of available versions of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyManagedPolicy`. To get the policy document for a specific version, use the `Get-IAMPolicyVersion` command and specify the `VersionId` of the one you want.**
```
Get-IAMPolicyVersionList -PolicyArn arn:aws:iam::123456789012:policy/MyManagedPolicy
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
2/12/2015 9:39:53 AM True v2
2/12/2015 9:39:09 AM False v1
```
+ For API details, see [ListPolicyVersions](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the list of available versions of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyManagedPolicy`. To get the policy document for a specific version, use the `Get-IAMPolicyVersion` command and specify the `VersionId` of the one you want.**
```
Get-IAMPolicyVersionList -PolicyArn arn:aws:iam::123456789012:policy/MyManagedPolicy
```
**Output:**
```
CreateDate Document IsDefaultVersion VersionId
---------- -------- ---------------- ---------
2/12/2015 9:39:53 AM True v2
2/12/2015 9:39:09 AM False v1
```
+ For API details, see [ListPolicyVersions](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listpolicyversions(
iv_policyarn = iv_policy_arn ).
MESSAGE 'Retrieved policy versions list.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing policy versions.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListPolicyVersions](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `ListRolePolicies` with an AWS SDK or CLI
The following code examples show how to use `ListRolePolicies`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List IAM role policies.
///
/// The IAM role for which to list IAM policies.
/// A list of IAM policy names.
public async Task> ListRolePoliciesAsync(string roleName)
{
var listRolePoliciesPaginator = _IAMService.Paginators.ListRolePolicies(new ListRolePoliciesRequest { RoleName = roleName });
var policyNames = new List();
await foreach (var response in listRolePoliciesPaginator.Responses)
{
policyNames.AddRange(response.PolicyNames);
}
return policyNames;
}
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListRolePolicies) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list the policies attached to an IAM role**
The following `list-role-policies` command lists the names of the permissions policies for the specified IAM role.
```
aws iam list-role-policies \
--role-name Test-Role
```
Output:
```
{
"PolicyNames": [
"ExamplePolicy"
]
}
```
To see the trust policy attached to a role, use the `get-role` command. To see the details of a permissions policy, use the `get-role-policy` command.
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
+ For API details, see [ListRolePolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-role-policies.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// ListRolePolicies lists the inline policies for a role.
func (wrapper RoleWrapper) ListRolePolicies(ctx context.Context, roleName string) ([]string, error) {
var policies []string
result, err := wrapper.IamClient.ListRolePolicies(ctx, &iam.ListRolePoliciesInput{
RoleName: aws.String(roleName),
})
if err != nil {
log.Printf("Couldn't list policies for role %v. Here's why: %v\n", roleName, err)
} else {
policies = result.PolicyNames
}
return policies, err
}
```
+ For API details, see [ListRolePolicies](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListRolePolicies) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the policies.
```
import { ListRolePoliciesCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*
* @param {string} roleName
*/
export async function* listRolePolicies(roleName) {
const command = new ListRolePoliciesCommand({
RoleName: roleName,
MaxItems: 10,
});
let response = await client.send(command);
while (response.PolicyNames?.length) {
for (const policyName of response.PolicyNames) {
yield policyName;
}
if (response.IsTruncated) {
response = await client.send(
new ListRolePoliciesCommand({
RoleName: roleName,
MaxItems: 10,
Marker: response.Marker,
}),
);
} else {
break;
}
}
}
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListRolePoliciesCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listRolePolicies($roleName, $marker = "", $maxItems = 0)
{
$listRolePoliciesArguments = ['RoleName' => $roleName];
if ($marker) {
$listRolePoliciesArguments['Marker'] = $marker;
}
if ($maxItems) {
$listRolePoliciesArguments['MaxItems'] = $maxItems;
}
return $this->customWaiter(function () use ($listRolePoliciesArguments) {
return $this->iamClient->listRolePolicies($listRolePoliciesArguments);
});
}
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListRolePolicies) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example returns the list of names of inline policies that are embedded in the IAM role `lamda_exec_role`. To see the details of an inline policy, use the command `Get-IAMRolePolicy`.**
```
Get-IAMRolePolicyList -RoleName lambda_exec_role
```
**Output:**
```
oneClick_lambda_exec_role_policy
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example returns the list of names of inline policies that are embedded in the IAM role `lamda_exec_role`. To see the details of an inline policy, use the command `Get-IAMRolePolicy`.**
```
Get-IAMRolePolicyList -RoleName lambda_exec_role
```
**Output:**
```
oneClick_lambda_exec_role_policy
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_policies(role_name):
"""
Lists inline policies for a role.
:param role_name: The name of the role to query.
"""
try:
role = iam.Role(role_name)
for policy in role.policies.all():
logger.info("Got inline policy %s.", policy.name)
except ClientError:
logger.exception("Couldn't list inline policies for %s.", role_name)
raise
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListRolePolicies) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Lists policy ARNs attached to a role
#
# @param role_name [String] The name of the role
# @return [Array] List of policy ARNs
def list_attached_policy_arns(role_name)
response = @iam_client.list_attached_role_policies(role_name: role_name)
response.attached_policies.map(&:policy_arn)
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing policies attached to role: #{e.message}")
[]
end
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListRolePolicies) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_role_policies(
client: &iamClient,
role_name: &str,
marker: Option,
max_items: Option,
) -> Result> {
let response = client
.list_role_policies()
.role_name(role_name)
.set_marker(marker)
.set_max_items(max_items)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [ListRolePolicies](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_role_policies) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listrolepolicies(
iv_rolename = iv_role_name ).
MESSAGE 'Retrieved inline policy list for role.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Role does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListRolePolicies](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func listRolePolicies(role: String) async throws -> [String] {
var policyList: [String] = []
// Use "Paginated" to get all the role policies.
// This lets the SDK handle the 'isTruncated' in "ListRolePoliciesOutput".
let input = ListRolePoliciesInput(
roleName: role
)
let pages = client.listRolePoliciesPaginated(input: input)
do {
for try await page in pages {
guard let policies = page.policyNames else {
print("Error: no role policies returned.")
continue
}
for policy in policies {
policyList.append(policy)
}
}
} catch {
print("ERROR: listRolePolicies:", dump(error))
throw error
}
return policyList
}
```
+ For API details, see [ListRolePolicies](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listrolepolicies(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListRoleTags` with a CLI
The following code examples show how to use `ListRoleTags`.
------
#### [ CLI ]
**AWS CLI**
**To list the tags attached to a role**
The following `list-role-tags` command retrieves the list of tags associated with the specified role.
```
aws iam list-role-tags \
--role-name production-role
```
Output:
```
{
"Tags": [
{
"Key": "Department",
"Value": "Accounting"
},
{
"Key": "DeptID",
"Value": "12345"
}
],
"IsTruncated": false
}
```
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [ListRoleTags](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-role-tags.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example fetches the tag associated with the role..**
```
Get-IAMRoleTagList -RoleName MyRoleName
```
+ For API details, see [ListRoleTags](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example fetches the tag associated with the role..**
```
Get-IAMRoleTagList -RoleName MyRoleName
```
+ For API details, see [ListRoleTags](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListRoles` with an AWS SDK or CLI
The following code examples show how to use `ListRoles`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List IAM roles.
///
/// A list of IAM roles.
public async Task> ListRolesAsync()
{
var listRolesPaginator = _IAMService.Paginators.ListRoles(new ListRolesRequest());
var roles = new List();
await foreach (var response in listRolesPaginator.Responses)
{
roles.AddRange(response.Roles);
}
return roles;
}
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListRoles) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list IAM roles for the current account**
The following `list-roles` command lists IAM roles for the current account.
```
aws iam list-roles
```
Output:
```
{
"Roles": [
{
"Path": "/",
"RoleName": "ExampleRole",
"RoleId": "AROAJ52OTH4H7LEXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/ExampleRole",
"CreateDate": "2017-09-12T19:23:36+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"MaxSessionDuration": 3600
},
{
"Path": "/example_path/",
"RoleName": "ExampleRoleWithPath",
"RoleId": "AROAI4QRP7UFT7EXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/example_path/ExampleRoleWithPath",
"CreateDate": "2023-09-21T20:29:38+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"MaxSessionDuration": 3600
}
]
}
```
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
+ For API details, see [ListRoles](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-roles.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// RoleWrapper encapsulates AWS Identity and Access Management (IAM) role actions
// used in the examples.
// It contains an IAM service client that is used to perform role actions.
type RoleWrapper struct {
IamClient *iam.Client
}
// ListRoles gets up to maxRoles roles.
func (wrapper RoleWrapper) ListRoles(ctx context.Context, maxRoles int32) ([]types.Role, error) {
var roles []types.Role
result, err := wrapper.IamClient.ListRoles(ctx,
&iam.ListRolesInput{MaxItems: aws.Int32(maxRoles)},
)
if err != nil {
log.Printf("Couldn't list roles. Here's why: %v\n", err)
} else {
roles = result.Roles
}
return roles, err
}
```
+ For API details, see [ListRoles](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListRoles) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the roles.
```
import { ListRolesCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*
*/
export async function* listRoles() {
const command = new ListRolesCommand({
MaxItems: 10,
});
/**
* @type {import("@aws-sdk/client-iam").ListRolesCommandOutput | undefined}
*/
let response = await client.send(command);
while (response?.Roles?.length) {
for (const role of response.Roles) {
yield role;
}
if (response.IsTruncated) {
response = await client.send(
new ListRolesCommand({
Marker: response.Marker,
}),
);
} else {
break;
}
}
}
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListRolesCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
/**
* @param string $pathPrefix
* @param string $marker
* @param int $maxItems
* @return Result
* $roles = $service->listRoles();
*/
public function listRoles($pathPrefix = "", $marker = "", $maxItems = 0)
{
$listRolesArguments = [];
if ($pathPrefix) {
$listRolesArguments["PathPrefix"] = $pathPrefix;
}
if ($marker) {
$listRolesArguments["Marker"] = $marker;
}
if ($maxItems) {
$listRolesArguments["MaxItems"] = $maxItems;
}
return $this->iamClient->listRoles($listRolesArguments);
}
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListRoles) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves a list of all of the IAM roles in the AWS account.**
```
Get-IAMRoleList
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves a list of all of the IAM roles in the AWS account.**
```
Get-IAMRoleList
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_roles(count):
"""
Lists the specified number of roles for the account.
:param count: The number of roles to list.
"""
try:
roles = list(iam.roles.limit(count=count))
for role in roles:
logger.info("Role: %s", role.name)
except ClientError:
logger.exception("Couldn't list roles for the account.")
raise
else:
return roles
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListRoles) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Lists IAM roles up to a specified count.
# @param count [Integer] the maximum number of roles to list.
# @return [Array] the names of the roles.
def list_roles(count)
role_names = []
roles_counted = 0
@iam_client.list_roles.each_page do |page|
page.roles.each do |role|
break if roles_counted >= count
@logger.info("\t#{roles_counted + 1}: #{role.role_name}")
role_names << role.role_name
roles_counted += 1
end
break if roles_counted >= count
end
role_names
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't list roles for the account. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListRoles) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_roles(
client: &iamClient,
path_prefix: Option,
marker: Option,
max_items: Option,
) -> Result> {
let response = client
.list_roles()
.set_path_prefix(path_prefix)
.set_marker(marker)
.set_max_items(max_items)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [ListRoles](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_roles) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listroles( ).
MESSAGE 'Retrieved role list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing roles.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListRoles](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func listRoles() async throws -> [String] {
var roleList: [String] = []
// Use "Paginated" to get all the roles.
// This lets the SDK handle the 'isTruncated' in "ListRolesOutput".
let input = ListRolesInput()
let pages = client.listRolesPaginated(input: input)
do {
for try await page in pages {
guard let roles = page.roles else {
print("Error: no roles returned.")
continue
}
for role in roles {
if let name = role.roleName {
roleList.append(name)
}
}
}
} catch {
print("ERROR: listRoles:", dump(error))
throw error
}
return roleList
}
```
+ For API details, see [ListRoles](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listroles(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListSAMLProviders` with an AWS SDK or CLI
The following code examples show how to use `ListSAMLProviders`.
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List SAML authentication providers.
///
/// A list of SAML providers.
public async Task> ListSAMLProvidersAsync()
{
var response = await _IAMService.ListSAMLProvidersAsync(new ListSAMLProvidersRequest());
return response.SAMLProviderList;
}
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListSAMLProviders) in *AWS SDK for .NET API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list the SAML providers in the AWS account**
This example retrieves the list of SAML 2.0 providers created in the current AWS account.
```
aws iam list-saml-providers
```
Output:
```
{
"SAMLProviderList": [
{
"Arn": "arn:aws:iam::123456789012:saml-provider/SAML-ADFS",
"ValidUntil": "2015-06-05T22:45:14Z",
"CreateDate": "2015-06-05T22:45:14Z"
}
]
}
```
For more information, see [Creating IAM SAML identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) in the *AWS IAM User Guide*.
+ For API details, see [ListSAMLProviders](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-saml-providers.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"log"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
)
// AccountWrapper encapsulates AWS Identity and Access Management (IAM) account actions
// used in the examples.
// It contains an IAM service client that is used to perform account actions.
type AccountWrapper struct {
IamClient *iam.Client
}
// ListSAMLProviders gets the SAML providers for the account.
func (wrapper AccountWrapper) ListSAMLProviders(ctx context.Context) ([]types.SAMLProviderListEntry, error) {
var providers []types.SAMLProviderListEntry
result, err := wrapper.IamClient.ListSAMLProviders(ctx, &iam.ListSAMLProvidersInput{})
if err != nil {
log.Printf("Couldn't list SAML providers. Here's why: %v\n", err)
} else {
providers = result.SAMLProviderList
}
return providers, err
}
```
+ For API details, see [ListSAMLProviders](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListSAMLProviders) in *AWS SDK for Go API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the SAML providers.
```
import { ListSAMLProvidersCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
export const listSamlProviders = async () => {
const command = new ListSAMLProvidersCommand({});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListSAMLProvidersCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listSAMLProviders()
{
return $this->iamClient->listSAMLProviders();
}
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListSAMLProviders) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves the list of SAML 2.0 providers created in the current AWS account. It returns the ARN, creation date, and expiration date for each SAML provider.**
```
Get-IAMSAMLProviderList
```
**Output:**
```
Arn CreateDate ValidUntil
--- ---------- ----------
arn:aws:iam::123456789012:saml-provider/SAMLADFS 12/23/2014 12:16:55 PM 12/23/2114 12:16:54 PM
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves the list of SAML 2.0 providers created in the current AWS account. It returns the ARN, creation date, and expiration date for each SAML provider.**
```
Get-IAMSAMLProviderList
```
**Output:**
```
Arn CreateDate ValidUntil
--- ---------- ----------
arn:aws:iam::123456789012:saml-provider/SAMLADFS 12/23/2014 12:16:55 PM 12/23/2114 12:16:54 PM
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_saml_providers(count):
"""
Lists the SAML providers for the account.
:param count: The maximum number of providers to list.
"""
try:
found = 0
for provider in iam.saml_providers.limit(count):
logger.info("Got SAML provider %s.", provider.arn)
found += 1
if found == 0:
logger.info("Your account has no SAML providers.")
except ClientError:
logger.exception("Couldn't list SAML providers.")
raise
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListSAMLProviders) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
class SamlProviderLister
# Initializes the SamlProviderLister with IAM client and a logger.
# @param iam_client [Aws::IAM::Client] The IAM client object.
# @param logger [Logger] The logger object for logging output.
def initialize(iam_client, logger = Logger.new($stdout))
@iam_client = iam_client
@logger = logger
end
# Lists up to a specified number of SAML providers for the account.
# @param count [Integer] The maximum number of providers to list.
# @return [Aws::IAM::Client::Response]
def list_saml_providers(count)
response = @iam_client.list_saml_providers
response.saml_provider_list.take(count).each do |provider|
@logger.info("\t#{provider.arn}")
end
response
rescue Aws::Errors::ServiceError => e
@logger.error("Couldn't list SAML providers. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
raise
end
end
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListSAMLProviders) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_saml_providers(
client: &Client,
) -> Result> {
let response = client.list_saml_providers().send().await?;
Ok(response)
}
```
+ For API details, see [ListSAMLProviders](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_saml_providers) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listsamlproviders( ).
MESSAGE 'Retrieved SAML provider list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing SAML providers.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListSAMLProviders](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `ListServerCertificates` with an AWS SDK or CLI
The following code examples show how to use `ListServerCertificates`.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::listServerCertificates(
const Aws::Client::ClientConfiguration &clientConfig) {
const Aws::String DATE_FORMAT = "%Y-%m-%d";
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListServerCertificatesRequest request;
bool done = false;
bool header = false;
while (!done) {
auto outcome = iam.ListServerCertificates(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to list server certificates: " <<
outcome.GetError().GetMessage() << std::endl;
return false;
}
if (!header) {
std::cout << std::left << std::setw(55) << "Name" <<
std::setw(30) << "ID" << std::setw(80) << "Arn" <<
std::setw(14) << "UploadDate" << std::setw(14) <<
"ExpirationDate" << std::endl;
header = true;
}
const auto &certificates =
outcome.GetResult().GetServerCertificateMetadataList();
for (const auto &certificate: certificates) {
std::cout << std::left << std::setw(55) <<
certificate.GetServerCertificateName() << std::setw(30) <<
certificate.GetServerCertificateId() << std::setw(80) <<
certificate.GetArn() << std::setw(14) <<
certificate.GetUploadDate().ToGmtString(DATE_FORMAT.c_str()) <<
std::setw(14) <<
certificate.GetExpiration().ToGmtString(DATE_FORMAT.c_str()) <<
std::endl;
}
if (outcome.GetResult().GetIsTruncated()) {
request.SetMarker(outcome.GetResult().GetMarker());
}
else {
done = true;
}
}
return true;
}
```
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/ListServerCertificates) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list the server certificates in your AWS account**
The following `list-server-certificates` command lists all of the server certificates stored and available for use in your AWS account.
```
aws iam list-server-certificates
```
Output:
```
{
"ServerCertificateMetadataList": [
{
"Path": "/",
"ServerCertificateName": "myUpdatedServerCertificate",
"ServerCertificateId": "ASCAEXAMPLE123EXAMPLE",
"Arn": "arn:aws:iam::123456789012:server-certificate/myUpdatedServerCertificate",
"UploadDate": "2019-04-22T21:13:44+00:00",
"Expiration": "2019-10-15T22:23:16+00:00"
},
{
"Path": "/cloudfront/",
"ServerCertificateName": "MyTestCert",
"ServerCertificateId": "ASCAEXAMPLE456EXAMPLE",
"Arn": "arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyTestCert",
"UploadDate": "2015-04-21T18:14:16+00:00",
"Expiration": "2018-01-14T17:52:36+00:00"
}
]
}
```
For more information, see [Managing server certificates in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) in the *AWS IAM User Guide*.
+ For API details, see [ListServerCertificates](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-server-certificates.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the certificates.
```
import { ListServerCertificatesCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
* A generator function that handles paginated results.
* The AWS SDK for JavaScript (v3) provides {@link https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html#paginators | paginator} functions to simplify this.
*
*/
export async function* listServerCertificates() {
const command = new ListServerCertificatesCommand({});
let response = await client.send(command);
while (response.ServerCertificateMetadataList?.length) {
for await (const cert of response.ServerCertificateMetadataList) {
yield cert;
}
if (response.IsTruncated) {
response = await client.send(new ListServerCertificatesCommand({}));
} else {
break;
}
}
}
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-listing).
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListServerCertificatesCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.listServerCertificates({}, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-listing).
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/ListServerCertificates) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves the list of server certificates that have been uploaded to the current AWS account.**
```
Get-IAMServerCertificateList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate
Expiration : 1/14/2018 9:52:36 AM
Path : /Org1/Org2/
ServerCertificateId : ASCAJIFEXAMPLE17HQZYW
ServerCertificateName : MyServerCertificate
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves the list of server certificates that have been uploaded to the current AWS account.**
```
Get-IAMServerCertificateList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate
Expiration : 1/14/2018 9:52:36 AM
Path : /Org1/Org2/
ServerCertificateId : ASCAJIFEXAMPLE17HQZYW
ServerCertificateName : MyServerCertificate
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, update, and delete server certificates.
```
class ServerCertificateManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'ServerCertificateManager'
end
# Creates a new server certificate.
# @param name [String] the name of the server certificate
# @param certificate_body [String] the contents of the certificate
# @param private_key [String] the private key contents
# @return [Boolean] returns true if the certificate was successfully created
def create_server_certificate(name, certificate_body, private_key)
@iam_client.upload_server_certificate({
server_certificate_name: name,
certificate_body: certificate_body,
private_key: private_key
})
true
rescue Aws::IAM::Errors::ServiceError => e
puts "Failed to create server certificate: #{e.message}"
false
end
# Lists available server certificate names.
def list_server_certificate_names
response = @iam_client.list_server_certificates
if response.server_certificate_metadata_list.empty?
@logger.info('No server certificates found.')
return
end
response.server_certificate_metadata_list.each do |certificate_metadata|
@logger.info("Certificate Name: #{certificate_metadata.server_certificate_name}")
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing server certificates: #{e.message}")
end
# Updates the name of a server certificate.
def update_server_certificate_name(current_name, new_name)
@iam_client.update_server_certificate(
server_certificate_name: current_name,
new_server_certificate_name: new_name
)
@logger.info("Server certificate name updated from '#{current_name}' to '#{new_name}'.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error updating server certificate name: #{e.message}")
false
end
# Deletes a server certificate.
def delete_server_certificate(name)
@iam_client.delete_server_certificate(server_certificate_name: name)
@logger.info("Server certificate '#{name}' deleted.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting server certificate: #{e.message}")
false
end
end
```
+ For API details, see [ListServerCertificates](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListServerCertificates) in *AWS SDK for Ruby API Reference*.
------
# Use `ListSigningCertificates` with a CLI
The following code examples show how to use `ListSigningCertificates`.
------
#### [ CLI ]
**AWS CLI**
**To list the signing certificates for an IAM user**
The following `list-signing-certificates` command lists the signing certificates for the IAM user named `Bob`.
```
aws iam list-signing-certificates \
--user-name Bob
```
Output:
```
{
"Certificates": [
{
"UserName": "Bob",
"Status": "Inactive",
"CertificateBody": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----",
"CertificateId": "TA7SMP42TDN5Z26OBPJE7EXAMPLE",
"UploadDate": "2013-06-06T21:40:08Z"
}
]
}
```
For more information, see [Manage signing certificates](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-up-ami-tools.html#ami-tools-managing-certs) in the *Amazon EC2 User Guide*.
+ For API details, see [ListSigningCertificates](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-signing-certificates.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves details about the signing certificate that is associated with the user named `Bob`.**
```
Get-IAMSigningCertificate -UserName Bob
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateId : Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU
Status : Active
UploadDate : 4/20/2015 1:26:01 PM
UserName : Bob
```
+ For API details, see [ListSigningCertificates](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves details about the signing certificate that is associated with the user named `Bob`.**
```
Get-IAMSigningCertificate -UserName Bob
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateId : Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU
Status : Active
UploadDate : 4/20/2015 1:26:01 PM
UserName : Bob
```
+ For API details, see [ListSigningCertificates](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListUserPolicies` with an AWS SDK or CLI
The following code examples show how to use `ListUserPolicies`.
------
#### [ CLI ]
**AWS CLI**
**To list policies for an IAM user**
The following `list-user-policies` command lists the policies that are attached to the IAM user named `Bob`.
```
aws iam list-user-policies \
--user-name Bob
```
Output:
```
{
"PolicyNames": [
"ExamplePolicy",
"TestPolicy"
]
}
```
For more information, see [Creating an IAM user in your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) in the *AWS IAM User Guide*.
+ For API details, see [ListUserPolicies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-user-policies.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// ListUserPolicies lists the inline policies for the specified user.
func (wrapper UserWrapper) ListUserPolicies(ctx context.Context, userName string) ([]string, error) {
var policies []string
result, err := wrapper.IamClient.ListUserPolicies(ctx, &iam.ListUserPoliciesInput{
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't list policies for user %v. Here's why: %v\n", userName, err)
} else {
policies = result.PolicyNames
}
return policies, err
}
```
+ For API details, see [ListUserPolicies](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListUserPolicies) in *AWS SDK for Go API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves the list of names of the inline policies that are embedded in the IAM user named `David`.**
```
Get-IAMUserPolicyList -UserName David
```
**Output:**
```
Davids_IAM_Admin_Policy
```
+ For API details, see [ListUserPolicies](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves the list of names of the inline policies that are embedded in the IAM user named `David`.**
```
Get-IAMUserPolicyList -UserName David
```
**Output:**
```
Davids_IAM_Admin_Policy
```
+ For API details, see [ListUserPolicies](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListUserTags` with a CLI
The following code examples show how to use `ListUserTags`.
------
#### [ CLI ]
**AWS CLI**
**To list the tags attached to a user**
The following `list-user-tags` command retrieves the list of tags associated with the specified IAM user.
```
aws iam list-user-tags \
--user-name alice
```
Output:
```
{
"Tags": [
{
"Key": "Department",
"Value": "Accounting"
},
{
"Key": "DeptID",
"Value": "12345"
}
],
"IsTruncated": false
}
```
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [ListUserTags](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-user-tags.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example fetches the tag associated with the user.**
```
Get-IAMUserTagList -UserName joe
```
+ For API details, see [ListUserTags](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example fetches the tag associated with the user.**
```
Get-IAMUserTagList -UserName joe
```
+ For API details, see [ListUserTags](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ListUsers` with an AWS SDK or CLI
The following code examples show how to use `ListUsers`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// List IAM users.
///
/// A list of IAM users.
public async Task> ListUsersAsync()
{
var listUsersPaginator = _IAMService.Paginators.ListUsers(new ListUsersRequest());
var users = new List();
await foreach (var response in listUsersPaginator.Responses)
{
users.AddRange(response.Users);
}
return users;
}
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/ListUsers) in *AWS SDK for .NET API Reference*.
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_list_users
#
# List the IAM users in the account.
#
# Returns:
# The list of users names
# And:
# 0 - If the user already exists.
# 1 - If the user doesn't exist.
###############################################################################
function iam_list_users() {
local option OPTARG # Required to use getopts command in a function.
local error_code
# bashsupport disable=BP5008
function usage() {
echo "function iam_list_users"
echo "Lists the AWS Identity and Access Management (IAM) user in the account."
echo ""
}
# Retrieve the calling parameters.
while getopts "h" option; do
case "${option}" in
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
local response
response=$(aws iam list-users \
--output text \
--query "Users[].UserName")
error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports list-users operation failed.$response"
return 1
fi
echo "$response"
return 0
}
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/ListUsers) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::listUsers(const Aws::Client::ClientConfiguration &clientConfig) {
const Aws::String DATE_FORMAT = "%Y-%m-%d";
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::ListUsersRequest request;
bool done = false;
bool header = false;
while (!done) {
auto outcome = iam.ListUsers(request);
if (!outcome.IsSuccess()) {
std::cerr << "Failed to list iam users:" <<
outcome.GetError().GetMessage() << std::endl;
return false;
}
if (!header) {
std::cout << std::left << std::setw(32) << "Name" <<
std::setw(30) << "ID" << std::setw(64) << "Arn" <<
std::setw(20) << "CreateDate" << std::endl;
header = true;
}
const auto &users = outcome.GetResult().GetUsers();
for (const auto &user: users) {
std::cout << std::left << std::setw(32) << user.GetUserName() <<
std::setw(30) << user.GetUserId() << std::setw(64) <<
user.GetArn() << std::setw(20) <<
user.GetCreateDate().ToGmtString(DATE_FORMAT.c_str())
<< std::endl;
}
if (outcome.GetResult().GetIsTruncated()) {
request.SetMarker(outcome.GetResult().GetMarker());
}
else {
done = true;
}
}
return true;
}
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/ListUsers) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To list IAM users**
The following `list-users` command lists the IAM users in the current account.
```
aws iam list-users
```
Output:
```
{
"Users": [
{
"UserName": "Adele",
"Path": "/",
"CreateDate": "2013-03-07T05:14:48Z",
"UserId": "AKIAI44QH8DHBEXAMPLE",
"Arn": "arn:aws:iam::123456789012:user/Adele"
},
{
"UserName": "Bob",
"Path": "/",
"CreateDate": "2012-09-21T23:03:13Z",
"UserId": "AKIAIOSFODNN7EXAMPLE",
"Arn": "arn:aws:iam::123456789012:user/Bob"
}
]
}
```
For more information, see [Listing IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html#id_users_manage_list) in the *AWS IAM User Guide*.
+ For API details, see [ListUsers](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-users.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// ListUsers gets up to maxUsers number of users.
func (wrapper UserWrapper) ListUsers(ctx context.Context, maxUsers int32) ([]types.User, error) {
var users []types.User
result, err := wrapper.IamClient.ListUsers(ctx, &iam.ListUsersInput{
MaxItems: aws.Int32(maxUsers),
})
if err != nil {
log.Printf("Couldn't list users. Here's why: %v\n", err)
} else {
users = result.Users
}
return users, err
}
```
+ For API details, see [ListUsers](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.ListUsers) in *AWS SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.AttachedPermissionsBoundary;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.ListUsersRequest;
import software.amazon.awssdk.services.iam.model.ListUsersResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.User;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class ListUsers {
public static void main(String[] args) {
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
listAllUsers(iam);
System.out.println("Done");
iam.close();
}
public static void listAllUsers(IamClient iam) {
try {
boolean done = false;
String newMarker = null;
while (!done) {
ListUsersResponse response;
if (newMarker == null) {
ListUsersRequest request = ListUsersRequest.builder().build();
response = iam.listUsers(request);
} else {
ListUsersRequest request = ListUsersRequest.builder()
.marker(newMarker)
.build();
response = iam.listUsers(request);
}
for (User user : response.users()) {
System.out.format("\n Retrieved user %s", user.userName());
AttachedPermissionsBoundary permissionsBoundary = user.permissionsBoundary();
if (permissionsBoundary != null)
System.out.format("\n Permissions boundary details %s",
permissionsBoundary.permissionsBoundaryTypeAsString());
}
if (!response.isTruncated()) {
done = true;
} else {
newMarker = response.marker();
}
}
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/ListUsers) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
List the users.
```
import { ListUsersCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
export const listUsers = async () => {
const command = new ListUsersCommand({ MaxItems: 10 });
const response = await client.send(command);
for (const { UserName, CreateDate } of response.Users) {
console.log(`${UserName} created on: ${CreateDate}`);
}
return response;
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-listing-users).
+ For API details, see [ListUsers](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/ListUsersCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
MaxItems: 10,
};
iam.listUsers(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
var users = data.Users || [];
users.forEach(function (user) {
console.log("User " + user.UserName + " created", user.CreateDate);
});
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-listing-users).
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/ListUsers) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun listAllUsers() {
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.listUsers(ListUsersRequest { })
response.users?.forEach { user ->
println("Retrieved user ${user.userName}")
val permissionsBoundary = user.permissionsBoundary
if (permissionsBoundary != null) {
println("Permissions boundary details ${permissionsBoundary.permissionsBoundaryType}")
}
}
}
}
```
+ For API details, see [ListUsers](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PHP ]
**SDK for PHP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/iam#code-examples).
```
$uuid = uniqid();
$service = new IAMService();
public function listUsers($pathPrefix = "", $marker = "", $maxItems = 0)
{
$listUsersArguments = [];
if ($pathPrefix) {
$listUsersArguments["PathPrefix"] = $pathPrefix;
}
if ($marker) {
$listUsersArguments["Marker"] = $marker;
}
if ($maxItems) {
$listUsersArguments["MaxItems"] = $maxItems;
}
return $this->iamClient->listUsers($listUsersArguments);
}
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/SdkForPHPV3/iam-2010-05-08/ListUsers) in *AWS SDK for PHP API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves a collection of users in the current AWS account.**
```
Get-IAMUserList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
PasswordLastUsed : 3/4/2015 12:12:33 PM
Path : /
UserId : 7K3GJEANSKZF2EXAMPLE1
UserName : Administrator
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : L3EWNONDOM3YUEXAMPLE2
UserName : bab
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE3
UserName : David
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves a collection of users in the current AWS account.**
```
Get-IAMUserList
```
**Output:**
```
Arn : arn:aws:iam::123456789012:user/Administrator
CreateDate : 10/16/2014 9:03:09 AM
PasswordLastUsed : 3/4/2015 12:12:33 PM
Path : /
UserId : 7K3GJEANSKZF2EXAMPLE1
UserName : Administrator
Arn : arn:aws:iam::123456789012:user/Bob
CreateDate : 4/6/2015 12:54:42 PM
PasswordLastUsed : 1/1/0001 12:00:00 AM
Path : /
UserId : L3EWNONDOM3YUEXAMPLE2
UserName : bab
Arn : arn:aws:iam::123456789012:user/David
CreateDate : 12/10/2014 3:39:27 PM
PasswordLastUsed : 3/19/2015 8:44:04 AM
Path : /
UserId : Y4FKWQCXTA52QEXAMPLE3
UserName : David
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def list_users():
"""
Lists the users in the current account.
:return: The list of users.
"""
try:
users = list(iam.users.all())
logger.info("Got %s users.", len(users))
except ClientError:
logger.exception("Couldn't get users.")
raise
else:
return users
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/ListUsers) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Lists all users in the AWS account
#
# @return [Array] An array of user objects
def list_users
users = []
@iam_client.list_users.each_page do |page|
page.users.each do |user|
users << user
end
end
users
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing users: #{e.message}")
[]
end
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/ListUsers) in *AWS SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn list_users(
client: &iamClient,
path_prefix: Option,
marker: Option,
max_items: Option,
) -> Result> {
let response = client
.list_users()
.set_path_prefix(path_prefix)
.set_marker(marker)
.set_max_items(max_items)
.send()
.await?;
Ok(response)
}
```
+ For API details, see [ListUsers](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.list_users) in *AWS SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->listusers( ).
MESSAGE 'Retrieved user list.' TYPE 'I'.
CATCH /aws1/cx_iamservicefailureex.
MESSAGE 'Service failure when listing users.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [ListUsers](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func listUsers() async throws -> [MyUserRecord] {
var userList: [MyUserRecord] = []
// Use "Paginated" to get all the users.
// This lets the SDK handle the 'isTruncated' in "ListUsersOutput".
let input = ListUsersInput()
let output = client.listUsersPaginated(input: input)
do {
for try await page in output {
guard let users = page.users else {
continue
}
for user in users {
if let id = user.userId, let name = user.userName {
userList.append(MyUserRecord(id: id, name: name))
}
}
}
}
catch {
print("ERROR: listUsers:", dump(error))
throw error
}
return userList
}
```
+ For API details, see [ListUsers](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/listusers(input:)) in *AWS SDK for Swift API reference*.
------
# Use `ListVirtualMfaDevices` with a CLI
The following code examples show how to use `ListVirtualMfaDevices`.
------
#### [ CLI ]
**AWS CLI**
**To list virtual MFA devices**
The following `list-virtual-mfa-devices` command lists the virtual MFA devices that have been configured for the current account.
```
aws iam list-virtual-mfa-devices
```
Output:
```
{
"VirtualMFADevices": [
{
"SerialNumber": "arn:aws:iam::123456789012:mfa/ExampleMFADevice"
},
{
"SerialNumber": "arn:aws:iam::123456789012:mfa/Fred"
}
]
}
```
For more information, see [Enabling a virtual multi-factor authentication (MFA) device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html) in the *AWS IAM User Guide*.
+ For API details, see [ListVirtualMfaDevices](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-virtual-mfa-devices.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example retrieves a collection of the virtual MFA devices that are assigned to users in the AWS account. The `User` property of each is an object with details of the IAM user to which the device is assigned.**
```
Get-IAMVirtualMFADevice -AssignmentStatus Assigned
```
**Output:**
```
Base32StringSeed :
EnableDate : 4/13/2015 12:03:42 PM
QRCodePNG :
SerialNumber : arn:aws:iam::123456789012:mfa/David
User : Amazon.IdentityManagement.Model.User
Base32StringSeed :
EnableDate : 4/13/2015 12:06:41 PM
QRCodePNG :
SerialNumber : arn:aws:iam::123456789012:mfa/root-account-mfa-device
User : Amazon.IdentityManagement.Model.User
```
+ For API details, see [ListVirtualMfaDevices](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example retrieves a collection of the virtual MFA devices that are assigned to users in the AWS account. The `User` property of each is an object with details of the IAM user to which the device is assigned.**
```
Get-IAMVirtualMFADevice -AssignmentStatus Assigned
```
**Output:**
```
Base32StringSeed :
EnableDate : 4/13/2015 12:03:42 PM
QRCodePNG :
SerialNumber : arn:aws:iam::123456789012:mfa/David
User : Amazon.IdentityManagement.Model.User
Base32StringSeed :
EnableDate : 4/13/2015 12:06:41 PM
QRCodePNG :
SerialNumber : arn:aws:iam::123456789012:mfa/root-account-mfa-device
User : Amazon.IdentityManagement.Model.User
```
+ For API details, see [ListVirtualMfaDevices](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `PutGroupPolicy` with a CLI
The following code examples show how to use `PutGroupPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To add a policy to a group**
The following `put-group-policy` command adds a policy to the IAM group named `Admins`.
```
aws iam put-group-policy \
--group-name Admins \
--policy-document file://AdminPolicy.json \
--policy-name AdminRoot
```
This command produces no output.
The policy is defined as a JSON document in the *AdminPolicy.json* file. (The file name and extension do not have significance.)
For more information, see [Managing IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html) in the *AWS IAM User Guide*.
+ For API details, see [PutGroupPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-group-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates an inline policy named `AppTesterPolicy` and embeds it in the IAM group `AppTesters`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes the file `apptesterpolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMGroupPolicy -GroupName AppTesters -PolicyName AppTesterPolicy -PolicyDocument (Get-Content -Raw apptesterpolicy.json)
```
+ For API details, see [PutGroupPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates an inline policy named `AppTesterPolicy` and embeds it in the IAM group `AppTesters`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes the file `apptesterpolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMGroupPolicy -GroupName AppTesters -PolicyName AppTesterPolicy -PolicyDocument (Get-Content -Raw apptesterpolicy.json)
```
+ For API details, see [PutGroupPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `PutRolePermissionsBoundary` with a CLI
The following code examples show how to use `PutRolePermissionsBoundary`.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To apply a permissions boundary based on a custom policy to an IAM role**
The following `put-role-permissions-boundary` example applies the custom policy named `intern-boundary` as the permissions boundary for the specified IAM role.
```
aws iam put-role-permissions-boundary \
--permissions-boundary arn:aws:iam::123456789012:policy/intern-boundary \
--role-name lambda-application-role
```
This command produces no output.
**Example 2: To apply a permissions boundary based on an AWS managed policy to an IAM role**
The following `put-role-permissions-boundary` example applies the AWS managed `PowerUserAccess` policy as the permissions boundary for the specified IAM role.
```
aws iam put-role-permissions-boundary \
--permissions-boundary arn:aws:iam::aws:policy/PowerUserAccess \
--role-name x-account-admin
```
This command produces no output.
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [PutRolePermissionsBoundary](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-role-permissions-boundary.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example shows how to set the Permission boundary for a IAM Role. You can set AWS Managed policies or Custom policies as permission boundary.**
```
Set-IAMRolePermissionsBoundary -RoleName MyRoleName -PermissionsBoundary arn:aws:iam::123456789012:policy/intern-boundary
```
+ For API details, see [PutRolePermissionsBoundary](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example shows how to set the Permission boundary for a IAM Role. You can set AWS Managed policies or Custom policies as permission boundary.**
```
Set-IAMRolePermissionsBoundary -RoleName MyRoleName -PermissionsBoundary arn:aws:iam::123456789012:policy/intern-boundary
```
+ For API details, see [PutRolePermissionsBoundary](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `PutRolePolicy` with an AWS SDK or CLI
The following code examples show how to use `PutRolePolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Get started with Redshift Serverless](iam_example_redshift_GettingStarted_038_section.md)
+ [Getting started with Amazon Redshift provisioned clusters](iam_example_redshift_GettingStarted_039_section.md)
+ [Getting started with Config](iam_example_config_service_GettingStarted_053_section.md)
+ [Getting Started with IoT Device Defender](iam_example_iot_GettingStarted_079_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ .NET ]
**SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Update the inline policy document embedded in a role.
///
/// The name of the policy to embed.
/// The name of the role to update.
/// The policy document that defines the role.
/// A Boolean value indicating the success of the action.
public async Task PutRolePolicyAsync(string policyName, string roleName, string policyDocument)
{
var request = new PutRolePolicyRequest
{
PolicyName = policyName,
RoleName = roleName,
PolicyDocument = policyDocument
};
var response = await _IAMService.PutRolePolicyAsync(request);
return response.HttpStatusCode == HttpStatusCode.OK;
}
```
+ For API details, see [PutRolePolicy](https://docs.aws.amazon.com/goto/DotNetSDKV3/iam-2010-05-08/PutRolePolicy) in *AWS SDK for .NET API Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::putRolePolicy(
const Aws::String &roleName,
const Aws::String &policyName,
const Aws::String &policyDocument,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iamClient(clientConfig);
Aws::IAM::Model::PutRolePolicyRequest request;
request.SetRoleName(roleName);
request.SetPolicyName(policyName);
request.SetPolicyDocument(policyDocument);
Aws::IAM::Model::PutRolePolicyOutcome outcome = iamClient.PutRolePolicy(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error putting policy on role. " <<
outcome.GetError().GetMessage() << std::endl;
}
else {
std::cout << "Successfully put the role policy." << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [PutRolePolicy](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/PutRolePolicy) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To attach a permissions policy to an IAM role**
The following `put-role-policy` command adds a permissions policy to the role named `Test-Role`.
```
aws iam put-role-policy \
--role-name Test-Role \
--policy-name ExamplePolicy \
--policy-document file://AdminPolicy.json
```
This command produces no output.
The policy is defined as a JSON document in the *AdminPolicy.json* file. (The file name and extension do not have significance.)
To attach a trust policy to a role, use the `update-assume-role-policy` command.
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [PutRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { PutRolePolicyCommand, IAMClient } from "@aws-sdk/client-iam";
const examplePolicyDocument = JSON.stringify({
Version: "2012-10-17",
Statement: [
{
Sid: "VisualEditor0",
Effect: "Allow",
Action: [
"s3:ListBucketMultipartUploads",
"s3:ListBucketVersions",
"s3:ListBucket",
"s3:ListMultipartUploadParts",
],
Resource: "arn:aws:s3:::amzn-s3-demo-bucket",
},
{
Sid: "VisualEditor1",
Effect: "Allow",
Action: [
"s3:ListStorageLensConfigurations",
"s3:ListAccessPointsForObjectLambda",
"s3:ListAllMyBuckets",
"s3:ListAccessPoints",
"s3:ListJobs",
"s3:ListMultiRegionAccessPoints",
],
Resource: "*",
},
],
});
const client = new IAMClient({});
/**
*
* @param {string} roleName
* @param {string} policyName
* @param {string} policyDocument
*/
export const putRolePolicy = async (roleName, policyName, policyDocument) => {
const command = new PutRolePolicyCommand({
RoleName: roleName,
PolicyName: policyName,
PolicyDocument: policyDocument,
});
const response = await client.send(command);
console.log(response);
return response;
};
```
+ For API details, see [PutRolePolicy](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/PutRolePolicyCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates an inline policy named `FedTesterRolePolicy` and embeds it in the IAM role `FedTesterRole`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes from the file `FedTesterPolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMRolePolicy -RoleName FedTesterRole -PolicyName FedTesterRolePolicy -PolicyDocument (Get-Content -Raw FedTesterPolicy.json)
```
+ For API details, see [PutRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates an inline policy named `FedTesterRolePolicy` and embeds it in the IAM role `FedTesterRole`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes from the file `FedTesterPolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMRolePolicy -RoleName FedTesterRole -PolicyName FedTesterRolePolicy -PolicyDocument (Get-Content -Raw FedTesterPolicy.json)
```
+ For API details, see [PutRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `PutUserPermissionsBoundary` with a CLI
The following code examples show how to use `PutUserPermissionsBoundary`.
------
#### [ CLI ]
**AWS CLI**
**Example 1: To apply a permissions boundary based on a custom policy to an IAM user**
The following `put-user-permissions-boundary` example applies a custom policy named `intern-boundary` as the permissions boundary for the specified IAM user.
```
aws iam put-user-permissions-boundary \
--permissions-boundary arn:aws:iam::123456789012:policy/intern-boundary \
--user-name intern
```
This command produces no output.
**Example 2: To apply a permissions boundary based on an AWS managed policy to an IAM user**
The following `put-user-permissions-boundary` example applies the AWS managed pollicy named `PowerUserAccess` as the permissions boundary for the specified IAM user.
```
aws iam put-user-permissions-boundary \
--permissions-boundary arn:aws:iam::aws:policy/PowerUserAccess \
--user-name developer
```
This command produces no output.
For more information, see [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *AWS IAM User Guide*.
+ For API details, see [PutUserPermissionsBoundary](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-user-permissions-boundary.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example shows how to set the Permission boundary for the user. You can set AWS Managed policies or Custom policies as permission boundary. **
```
Set-IAMUserPermissionsBoundary -UserName joe -PermissionsBoundary arn:aws:iam::123456789012:policy/intern-boundary
```
+ For API details, see [PutUserPermissionsBoundary](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example shows how to set the Permission boundary for the user. You can set AWS Managed policies or Custom policies as permission boundary. **
```
Set-IAMUserPermissionsBoundary -UserName joe -PermissionsBoundary arn:aws:iam::123456789012:policy/intern-boundary
```
+ For API details, see [PutUserPermissionsBoundary](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `PutUserPolicy` with an AWS SDK or CLI
The following code examples show how to use `PutUserPolicy`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
------
#### [ CLI ]
**AWS CLI**
**To attach a policy to an IAM user**
The following `put-user-policy` command attaches a policy to the IAM user named `Bob`.
```
aws iam put-user-policy \
--user-name Bob \
--policy-name ExamplePolicy \
--policy-document file://AdminPolicy.json
```
This command produces no output.
The policy is defined as a JSON document in the *AdminPolicy.json* file. (The file name and extension do not have significance.)
For more information, see [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *AWS IAM User Guide*.
+ For API details, see [PutUserPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/put-user-policy.html) in *AWS CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// CreateUserPolicy adds an inline policy to a user. This example creates a policy that
// grants a list of actions on a specified role.
// PolicyDocument shows how to work with a policy document as a data structure and
// serialize it to JSON by using Go's JSON marshaler.
func (wrapper UserWrapper) CreateUserPolicy(ctx context.Context, userName string, policyName string, actions []string,
roleArn string) error {
policyDoc := PolicyDocument{
Version: "2012-10-17",
Statement: []PolicyStatement{{
Effect: "Allow",
Action: actions,
Resource: aws.String(roleArn),
}},
}
policyBytes, err := json.Marshal(policyDoc)
if err != nil {
log.Printf("Couldn't create policy document for %v. Here's why: %v\n", roleArn, err)
return err
}
_, err = wrapper.IamClient.PutUserPolicy(ctx, &iam.PutUserPolicyInput{
PolicyDocument: aws.String(string(policyBytes)),
PolicyName: aws.String(policyName),
UserName: aws.String(userName),
})
if err != nil {
log.Printf("Couldn't create policy for user %v. Here's why: %v\n", userName, err)
}
return err
}
```
+ For API details, see [PutUserPolicy](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.PutUserPolicy) in *AWS SDK for Go API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates an inline policy named `EC2AccessPolicy` and embeds it in the IAM user `Bob`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes from the file `EC2AccessPolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMUserPolicy -UserName Bob -PolicyName EC2AccessPolicy -PolicyDocument (Get-Content -Raw EC2AccessPolicy.json)
```
+ For API details, see [PutUserPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates an inline policy named `EC2AccessPolicy` and embeds it in the IAM user `Bob`. If an inline policy with the same name already exists, then it is overwritten. The JSON policy content comes from the file `EC2AccessPolicy.json`. Note that you must use the `-Raw` parameter to successfully process the content of the JSON file.**
```
Write-IAMUserPolicy -UserName Bob -PolicyName EC2AccessPolicy -PolicyDocument (Get-Content -Raw EC2AccessPolicy.json)
```
+ For API details, see [PutUserPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Creates an inline policy for a specified user.
# @param username [String] The name of the IAM user.
# @param policy_name [String] The name of the policy to create.
# @param policy_document [String] The JSON policy document.
# @return [Boolean]
def create_user_policy(username, policy_name, policy_document)
@iam_client.put_user_policy({
user_name: username,
policy_name: policy_name,
policy_document: policy_document
})
@logger.info("Policy #{policy_name} created for user #{username}.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Couldn't create policy #{policy_name} for user #{username}. Here's why:")
@logger.error("\t#{e.code}: #{e.message}")
false
end
```
+ For API details, see [PutUserPolicy](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/PutUserPolicy) in *AWS SDK for Ruby API Reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
func putUserPolicy(policyDocument: String, policyName: String, user: IAMClientTypes.User) async throws {
let input = PutUserPolicyInput(
policyDocument: policyDocument,
policyName: policyName,
userName: user.userName
)
do {
_ = try await iamClient.putUserPolicy(input: input)
} catch {
print("ERROR: putUserPolicy:", dump(error))
throw error
}
}
```
+ For API details, see [PutUserPolicy](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/putuserpolicy(input:)) in *AWS SDK for Swift API reference*.
------
# Use `RemoveClientIdFromOpenIdConnectProvider` with a CLI
The following code examples show how to use `RemoveClientIdFromOpenIdConnectProvider`.
------
#### [ CLI ]
**AWS CLI**
**To remove the specified client ID from the list of client IDs registered for the specified IAM OpenID Connect provider**
This example removes the client ID `My-TestApp-3` from the list of client IDs associated with the IAM OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com`.
```
aws iam remove-client-id-from-open-id-connect-provider
--client-id My-TestApp-3 \
--open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
This command produces no output.
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [RemoveClientIdFromOpenIdConnectProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/remove-client-id-from-open-id-connect-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the client ID `My-TestApp-3` from the list of client IDs associated with the IAM OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com`.**
```
Remove-IAMClientIDFromOpenIDConnectProvider -ClientID My-TestApp-3 -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [RemoveClientIdFromOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the client ID `My-TestApp-3` from the list of client IDs associated with the IAM OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com`.**
```
Remove-IAMClientIDFromOpenIDConnectProvider -ClientID My-TestApp-3 -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com
```
+ For API details, see [RemoveClientIdFromOpenIdConnectProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `RemoveRoleFromInstanceProfile` with a CLI
The following code examples show how to use `RemoveRoleFromInstanceProfile`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Getting started with Amazon MSK](iam_example_ec2_GettingStarted_057_section.md)
+ [Run CPU stress tests on EC2 instances using FIS](iam_example_iam_GettingStarted_069_section.md)
------
#### [ CLI ]
**AWS CLI**
**To remove a role from an instance profile**
The following `remove-role-from-instance-profile` command removes the role named `Test-Role` from the instance profile named `ExampleInstanceProfile`.
```
aws iam remove-role-from-instance-profile \
--instance-profile-name ExampleInstanceProfile \
--role-name Test-Role
```
For more information, see [Using instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) in the *AWS IAM User Guide*.
+ For API details, see [RemoveRoleFromInstanceProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/remove-role-from-instance-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example deletes the role named `MyNewRole` from the EC2 instance profile named `MyNewRole`. An instance profile that is created in the IAM console always has the same name as the role, as in this example. If you create them in the API or CLI, then they can have different names.**
```
Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyNewRole -RoleName MyNewRole -Force
```
+ For API details, see [RemoveRoleFromInstanceProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example deletes the role named `MyNewRole` from the EC2 instance profile named `MyNewRole`. An instance profile that is created in the IAM console always has the same name as the role, as in this example. If you create them in the API or CLI, then they can have different names.**
```
Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyNewRole -RoleName MyNewRole -Force
```
+ For API details, see [RemoveRoleFromInstanceProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `RemoveUserFromGroup` with a CLI
The following code examples show how to use `RemoveUserFromGroup`.
------
#### [ CLI ]
**AWS CLI**
**To remove a user from an IAM group**
The following `remove-user-from-group` command removes the user named `Bob` from the IAM group named `Admins`.
```
aws iam remove-user-from-group \
--user-name Bob \
--group-name Admins
```
This command produces no output.
For more information, see [Adding and removing users in an IAM user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_add-remove-users.html) in the *AWS IAM User Guide*.
+ For API details, see [RemoveUserFromGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/remove-user-from-group.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the IAM user `Bob` from the group `Testers`. **
```
Remove-IAMUserFromGroup -GroupName Testers -UserName Bob
```
**Example 2: This example finds any groups of which IAM user `Theresa` is a member, and then removes `Theresa` from those groups.**
```
$groups = Get-IAMGroupForUser -UserName Theresa
foreach ($group in $groups) { Remove-IAMUserFromGroup -GroupName $group.GroupName -UserName Theresa -Force }
```
**Example 3: This example shows an alternate way of removing the IAM user `Bob` from the `Testers` group.**
```
Get-IAMGroupForUser -UserName Bob | Remove-IAMUserFromGroup -UserName Bob -GroupName Testers -Force
```
+ For API details, see [RemoveUserFromGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the IAM user `Bob` from the group `Testers`. **
```
Remove-IAMUserFromGroup -GroupName Testers -UserName Bob
```
**Example 2: This example finds any groups of which IAM user `Theresa` is a member, and then removes `Theresa` from those groups.**
```
$groups = Get-IAMGroupForUser -UserName Theresa
foreach ($group in $groups) { Remove-IAMUserFromGroup -GroupName $group.GroupName -UserName Theresa -Force }
```
**Example 3: This example shows an alternate way of removing the IAM user `Bob` from the `Testers` group.**
```
Get-IAMGroupForUser -UserName Bob | Remove-IAMUserFromGroup -UserName Bob -GroupName Testers -Force
```
+ For API details, see [RemoveUserFromGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `ResyncMfaDevice` with a CLI
The following code examples show how to use `ResyncMfaDevice`.
------
#### [ CLI ]
**AWS CLI**
**To synchronize an MFA device**
The following `resync-mfa-device` example synchronizes the MFA device that is associated with the IAM user `Bob` and whose ARN is `arn:aws:iam::123456789012:mfa/BobsMFADevice` with an authenticator program that provided the two authentication codes.
```
aws iam resync-mfa-device \
--user-name Bob \
--serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice \
--authentication-code1 123456 \
--authentication-code2 987654
```
This command produces no output.
For more information, see [Using multi-factor authentication (MFA) in AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) in the *AWS IAM User Guide*.
+ For API details, see [ResyncMfaDevice](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/resync-mfa-device.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example synchronizes the MFA device that is associated with the IAM user `Bob` and whose ARN is `arn:aws:iam::123456789012:mfa/bob` with an authenticator program that provided the two authentication codes.**
```
Sync-IAMMFADevice -SerialNumber arn:aws:iam::123456789012:mfa/theresa -AuthenticationCode1 123456 -AuthenticationCode2 987654 -UserName Bob
```
**Example 2: This example synchronizes the IAM MFA device that is associated with the IAM user `Theresa` with a physical device that has the serial number `ABCD12345678` and that provided the two authentication codes.**
```
Sync-IAMMFADevice -SerialNumber ABCD12345678 -AuthenticationCode1 123456 -AuthenticationCode2 987654 -UserName Theresa
```
+ For API details, see [ResyncMfaDevice](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example synchronizes the MFA device that is associated with the IAM user `Bob` and whose ARN is `arn:aws:iam::123456789012:mfa/bob` with an authenticator program that provided the two authentication codes.**
```
Sync-IAMMFADevice -SerialNumber arn:aws:iam::123456789012:mfa/theresa -AuthenticationCode1 123456 -AuthenticationCode2 987654 -UserName Bob
```
**Example 2: This example synchronizes the IAM MFA device that is associated with the IAM user `Theresa` with a physical device that has the serial number `ABCD12345678` and that provided the two authentication codes.**
```
Sync-IAMMFADevice -SerialNumber ABCD12345678 -AuthenticationCode1 123456 -AuthenticationCode2 987654 -UserName Theresa
```
+ For API details, see [ResyncMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `SetDefaultPolicyVersion` with an AWS SDK or CLI
The following code examples show how to use `SetDefaultPolicyVersion`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Manage policies](iam_example_iam_Scenario_PolicyManagement_section.md)
+ [Roll back a policy version](iam_example_iam_Scenario_RollbackPolicyVersion_section.md)
------
#### [ CLI ]
**AWS CLI**
**To set the specified version of the specified policy as the policy's default version.**
This example sets the `v2` version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` as the default active version.
```
aws iam set-default-policy-version \
--policy-arn arn:aws:iam::123456789012:policy/MyPolicy \
--version-id v2
```
For more information, see [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *AWS IAM User Guide*.
+ For API details, see [SetDefaultPolicyVersion](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/set-default-policy-version.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example sets the `v2` version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` as the default active version.**
```
Set-IAMDefaultPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyPolicy -VersionId v2
```
+ For API details, see [SetDefaultPolicyVersion](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example sets the `v2` version of the policy whose ARN is `arn:aws:iam::123456789012:policy/MyPolicy` as the default active version.**
```
Set-IAMDefaultPolicyVersion -PolicyArn arn:aws:iam::123456789012:policy/MyPolicy -VersionId v2
```
+ For API details, see [SetDefaultPolicyVersion](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->setdefaultpolicyversion(
iv_policyarn = iv_policy_arn
iv_versionid = iv_version_id ).
MESSAGE 'Default policy version set successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Policy or version does not exist.' TYPE 'E'.
CATCH /aws1/cx_iaminvalidinputex.
MESSAGE 'Invalid input provided.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Limit exceeded.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [SetDefaultPolicyVersion](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `TagRole` with a CLI
The following code examples show how to use `TagRole`.
------
#### [ CLI ]
**AWS CLI**
**To add a tag to a role**
The following `tag-role` command adds a tag with a Department name to the specified role.
```
aws iam tag-role --role-name my-role \
--tags '{"Key": "Department", "Value": "Accounting"}'
```
This command produces no output.
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [TagRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/tag-role.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example adds tag to Role in Identity Management Service**
```
Add-IAMRoleTag -RoleName AdminRoleacess -Tag @{ Key = 'abac'; Value = 'testing'}
```
+ For API details, see [TagRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example adds tag to Role in Identity Management Service**
```
Add-IAMRoleTag -RoleName AdminRoleacess -Tag @{ Key = 'abac'; Value = 'testing'}
```
+ For API details, see [TagRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `TagUser` with a CLI
The following code examples show how to use `TagUser`.
------
#### [ CLI ]
**AWS CLI**
**To add a tag to a user**
The following `tag-user` command adds a tag with the associated Department to the specified user.
```
aws iam tag-user \
--user-name alice \
--tags '{"Key": "Department", "Value": "Accounting"}'
```
This command produces no output.
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [TagUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/tag-user.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example adds tag to User in Identity Management Service**
```
Add-IAMUserTag -UserName joe -Tag @{ Key = 'abac'; Value = 'testing'}
```
+ For API details, see [TagUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example adds tag to User in Identity Management Service**
```
Add-IAMUserTag -UserName joe -Tag @{ Key = 'abac'; Value = 'testing'}
```
+ For API details, see [TagUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UntagRole` with a CLI
The following code examples show how to use `UntagRole`.
------
#### [ CLI ]
**AWS CLI**
**To remove a tag from a role**
The following `untag-role` command removes any tag with the key name 'Department' from the specified role.
```
aws iam untag-role \
--role-name my-role \
--tag-keys Department
```
This command produces no output.
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [UntagRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/untag-role.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the tag from the role named "MyRoleName" with tag key as "abac". To remove multiple tags, provide a comma separted tag keys list.**
```
Remove-IAMRoleTag -RoleName MyRoleName -TagKey "abac","xyzw"
```
+ For API details, see [UntagRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the tag from the role named "MyRoleName" with tag key as "abac". To remove multiple tags, provide a comma separted tag keys list.**
```
Remove-IAMRoleTag -RoleName MyRoleName -TagKey "abac","xyzw"
```
+ For API details, see [UntagRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UntagUser` with a CLI
The following code examples show how to use `UntagUser`.
------
#### [ CLI ]
**AWS CLI**
**To remove a tag from a user**
The following `untag-user` command removes any tag with the key name 'Department' from the specified user.
```
aws iam untag-user \
--user-name alice \
--tag-keys Department
```
This command produces no output.
For more information, see [Tagging IAM resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html) in the *AWS IAM User Guide*.
+ For API details, see [UntagUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/untag-user.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example removes the tag from the user named "joe" with tag key as "abac" and "xyzw". To remove multiple tags, provide a comma separted tag keys list.**
```
Remove-IAMUserTag -UserName joe -TagKey "abac","xyzw"
```
+ For API details, see [UntagUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example removes the tag from the user named "joe" with tag key as "abac" and "xyzw". To remove multiple tags, provide a comma separted tag keys list.**
```
Remove-IAMUserTag -UserName joe -TagKey "abac","xyzw"
```
+ For API details, see [UntagUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateAccessKey` with an AWS SDK or CLI
The following code examples show how to use `UpdateAccessKey`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ Bash ]
**AWS CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function iam_update_access_key
#
# This function can activate or deactivate an IAM access key for the specified IAM user.
#
# Parameters:
# -u user_name -- The name of the user.
# -k access_key -- The access key to update.
# -a -- Activate the selected access key.
# -d -- Deactivate the selected access key.
#
# Example:
# # To deactivate the selected access key for IAM user Bob
# iam_update_access_key -u Bob -k AKIAIOSFODNN7EXAMPLE -d
#
# Returns:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_update_access_key() {
local user_name access_key status response
local option OPTARG # Required to use getopts command in a function.
local activate_flag=false deactivate_flag=false
# bashsupport disable=BP5008
function usage() {
echo "function iam_update_access_key"
echo "Updates the status of an AWS Identity and Access Management (IAM) access key for the specified IAM user"
echo " -u user_name The name of the user."
echo " -k access_key The access key to update."
echo " -a Activate the access key."
echo " -d Deactivate the access key."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:k:adh" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
k) access_key="${OPTARG}" ;;
a) activate_flag=true ;;
d) deactivate_flag=true ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
# Validate input parameters
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
if [[ -z "$access_key" ]]; then
errecho "ERROR: You must provide an access key with the -k parameter."
usage
return 1
fi
# Ensure that only -a or -d is specified
if [[ "$activate_flag" == true && "$deactivate_flag" == true ]]; then
errecho "ERROR: You cannot specify both -a (activate) and -d (deactivate) at the same time."
usage
return 1
fi
# If neither -a nor -d is provided, return an error
if [[ "$activate_flag" == false && "$deactivate_flag" == false ]]; then
errecho "ERROR: You must specify either -a (activate) or -d (deactivate)."
usage
return 1
fi
# Determine the status based on the flag
if [[ "$activate_flag" == true ]]; then
status="Active"
elif [[ "$deactivate_flag" == true ]]; then
status="Inactive"
fi
iecho "Parameters:\n"
iecho " Username: $user_name"
iecho " Access key: $access_key"
iecho " New status: $status"
iecho ""
# Update the access key status
response=$(aws iam update-access-key \
--user-name "$user_name" \
--access-key-id "$access_key" \
--status "$status" 2>&1)
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports update-access-key operation failed.\n$response"
return 1
fi
iecho "update-access-key response: $response"
iecho
return 0
}
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/goto/aws-cli/iam-2010-05-08/UpdateAccessKey) in *AWS CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::updateAccessKey(const Aws::String &userName,
const Aws::String &accessKeyID,
Aws::IAM::Model::StatusType status,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::UpdateAccessKeyRequest request;
request.SetUserName(userName);
request.SetAccessKeyId(accessKeyID);
request.SetStatus(status);
auto outcome = iam.UpdateAccessKey(request);
if (outcome.IsSuccess()) {
std::cout << "Successfully updated status of access key "
<< accessKeyID << " for user " << userName << std::endl;
}
else {
std::cerr << "Error updated status of access key " << accessKeyID <<
" for user " << userName << ": " <<
outcome.GetError().GetMessage() << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/UpdateAccessKey) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To activate or deactivate an access key for an IAM user**
The following `update-access-key` command deactivates the specified access key (access key ID and secret access key) for the IAM user named `Bob`.
```
aws iam update-access-key \
--access-key-id AKIAIOSFODNN7EXAMPLE \
--status Inactive \
--user-name Bob
```
This command produces no output.
Deactivating the key means that it cannot be used for programmatic access to AWS. However, the key is still available and can be reactivated.
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateAccessKey](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-access-key.html) in *AWS CLI Command Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.StatusType;
import software.amazon.awssdk.services.iam.model.UpdateAccessKeyRequest;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class UpdateAccessKey {
private static StatusType statusType;
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
username - The name of the user whose key you want to update.\s
accessId - The access key ID of the secret access key you want to update.\s
status - The status you want to assign to the secret access key.\s
""";
if (args.length != 3) {
System.out.println(usage);
System.exit(1);
}
String username = args[0];
String accessId = args[1];
String status = args[2];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
updateKey(iam, username, accessId, status);
System.out.println("Done");
iam.close();
}
public static void updateKey(IamClient iam, String username, String accessId, String status) {
try {
if (status.toLowerCase().equalsIgnoreCase("active")) {
statusType = StatusType.ACTIVE;
} else if (status.toLowerCase().equalsIgnoreCase("inactive")) {
statusType = StatusType.INACTIVE;
} else {
statusType = StatusType.UNKNOWN_TO_SDK_VERSION;
}
UpdateAccessKeyRequest request = UpdateAccessKeyRequest.builder()
.accessKeyId(accessId)
.userName(username)
.status(statusType)
.build();
iam.updateAccessKey(request);
System.out.printf("Successfully updated the status of access key %s to" +
"status %s for user %s", accessId, status, username);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/UpdateAccessKey) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Update the access key.
```
import {
UpdateAccessKeyCommand,
IAMClient,
StatusType,
} from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} userName
* @param {string} accessKeyId
*/
export const updateAccessKey = (userName, accessKeyId) => {
const command = new UpdateAccessKeyCommand({
AccessKeyId: accessKeyId,
Status: StatusType.Inactive,
UserName: userName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-updating).
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/UpdateAccessKeyCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
AccessKeyId: "ACCESS_KEY_ID",
Status: "Active",
UserName: "USER_NAME",
};
iam.updateAccessKey(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-updating).
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/UpdateAccessKey) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example changes the status of the access key `AKIAIOSFODNN7EXAMPLE` for the IAM user named `Bob` to `Inactive`.**
```
Update-IAMAccessKey -UserName Bob -AccessKeyId AKIAIOSFODNN7EXAMPLE -Status Inactive
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example changes the status of the access key `AKIAIOSFODNN7EXAMPLE` for the IAM user named `Bob` to `Inactive`.**
```
Update-IAMAccessKey -UserName Bob -AccessKeyId AKIAIOSFODNN7EXAMPLE -Status Inactive
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def update_key(user_name, key_id, activate):
"""
Updates the status of a key.
:param user_name: The user that owns the key.
:param key_id: The ID of the key to update.
:param activate: When True, the key is activated. Otherwise, the key is deactivated.
"""
try:
key = iam.User(user_name).AccessKey(key_id)
if activate:
key.activate()
else:
key.deactivate()
logger.info("%s key %s.", "Activated" if activate else "Deactivated", key_id)
except ClientError:
logger.exception(
"Couldn't %s key %s.", "Activate" if activate else "Deactivate", key_id
)
raise
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/UpdateAccessKey) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->updateaccesskey(
iv_accesskeyid = iv_access_key_id
iv_status = iv_status
iv_username = iv_user_name ).
MESSAGE 'Access key updated successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'Access key or user does not exist.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [UpdateAccessKey](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `UpdateAccountPasswordPolicy` with a CLI
The following code examples show how to use `UpdateAccountPasswordPolicy`.
------
#### [ CLI ]
**AWS CLI**
**To set or change the current account password policy**
The following `update-account-password-policy` command sets the password policy to require a minimum length of eight characters and to require one or more numbers in the password.
```
aws iam update-account-password-policy \
--minimum-password-length 8 \
--require-numbers
```
This command produces no output.
Changes to an account's password policy affect any new passwords that are created for IAM users in the account. Password policy changes do not affect existing passwords.
For more information, see [Setting an account password policy for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateAccountPasswordPolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-account-password-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the password policy for the account with the specified settings. Note that any parameters that are not included in the command are not left unmodified. Instead, they are reset to default values.**
```
Update-IAMAccountPasswordPolicy -AllowUsersToChangePasswords $true -HardExpiry $false -MaxPasswordAge 90 -MinimumPasswordLength 8 -PasswordReusePrevention 20 -RequireLowercaseCharacters $true -RequireNumbers $true -RequireSymbols $true -RequireUppercaseCharacters $true
```
+ For API details, see [UpdateAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the password policy for the account with the specified settings. Note that any parameters that are not included in the command are not left unmodified. Instead, they are reset to default values.**
```
Update-IAMAccountPasswordPolicy -AllowUsersToChangePasswords $true -HardExpiry $false -MaxPasswordAge 90 -MinimumPasswordLength 8 -PasswordReusePrevention 20 -RequireLowercaseCharacters $true -RequireNumbers $true -RequireSymbols $true -RequireUppercaseCharacters $true
```
+ For API details, see [UpdateAccountPasswordPolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateAssumeRolePolicy` with a CLI
The following code examples show how to use `UpdateAssumeRolePolicy`.
------
#### [ CLI ]
**AWS CLI**
**To update the trust policy for an IAM role**
The following `update-assume-role-policy` command updates the trust policy for the role named `Test-Role`.
```
aws iam update-assume-role-policy \
--role-name Test-Role \
--policy-document file://Test-Role-Trust-Policy.json
```
This command produces no output.
The trust policy is defined as a JSON document in the *Test-Role-Trust-Policy.json* file. (The file name and extension do not have significance.) The trust policy must specify a principal.
To update the permissions policy for a role, use the `put-role-policy` command.
For more information, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateAssumeRolePolicy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the IAM role named `ClientRole` with a new trust policy, the contents of which come from the file `ClientRolePolicy.json`. Note that you must use the `-Raw` switch parameter to successfully process the contents of the JSON file.**
```
Update-IAMAssumeRolePolicy -RoleName ClientRole -PolicyDocument (Get-Content -raw ClientRolePolicy.json)
```
+ For API details, see [UpdateAssumeRolePolicy](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the IAM role named `ClientRole` with a new trust policy, the contents of which come from the file `ClientRolePolicy.json`. Note that you must use the `-Raw` switch parameter to successfully process the contents of the JSON file.**
```
Update-IAMAssumeRolePolicy -RoleName ClientRole -PolicyDocument (Get-Content -raw ClientRolePolicy.json)
```
+ For API details, see [UpdateAssumeRolePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateGroup` with a CLI
The following code examples show how to use `UpdateGroup`.
------
#### [ CLI ]
**AWS CLI**
**To rename an IAM group**
The following `update-group` command changes the name of the IAM group `Test` to `Test-1`.
```
aws iam update-group \
--group-name Test \
--new-group-name Test-1
```
This command produces no output.
For more information, see [Renaming an IAM user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_rename.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-group.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example renames the IAM group `Testers` to `AppTesters`.**
```
Update-IAMGroup -GroupName Testers -NewGroupName AppTesters
```
**Example 2: This example changes the path of the IAM group `AppTesters` to `/Org1/Org2/`. This changes the ARN for the group to `arn:aws:iam::123456789012:group/Org1/Org2/AppTesters`.**
```
Update-IAMGroup -GroupName AppTesters -NewPath /Org1/Org2/
```
+ For API details, see [UpdateGroup](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example renames the IAM group `Testers` to `AppTesters`.**
```
Update-IAMGroup -GroupName Testers -NewGroupName AppTesters
```
**Example 2: This example changes the path of the IAM group `AppTesters` to `/Org1/Org2/`. This changes the ARN for the group to `arn:aws:iam::123456789012:group/Org1/Org2/AppTesters`.**
```
Update-IAMGroup -GroupName AppTesters -NewPath /Org1/Org2/
```
+ For API details, see [UpdateGroup](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateLoginProfile` with a CLI
The following code examples show how to use `UpdateLoginProfile`.
------
#### [ CLI ]
**AWS CLI**
**To update the password for an IAM user**
The following `update-login-profile` command creates a new password for the IAM user named `Bob`.
```
aws iam update-login-profile \
--user-name Bob \
--password
```
This command produces no output.
To set a password policy for the account, use the `update-account-password-policy` command. If the new password violates the account password policy, the command returns a `PasswordPolicyViolation` error.
If the account password policy allows them to, IAM users can change their own passwords using the `change-password` command.
Store the password in a secure place. If the password is lost, it cannot be recovered, and you must create a new one using the `create-login-profile` command.
For more information, see [Managing passwords for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateLoginProfile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-login-profile.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example sets a new temporary password for the IAM user `Bob`, and requires the user to change the password the next time the user signs in.**
```
Update-IAMLoginProfile -UserName Bob -Password "P@ssw0rd1234" -PasswordResetRequired $true
```
+ For API details, see [UpdateLoginProfile](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example sets a new temporary password for the IAM user `Bob`, and requires the user to change the password the next time the user signs in.**
```
Update-IAMLoginProfile -UserName Bob -Password "P@ssw0rd1234" -PasswordResetRequired $true
```
+ For API details, see [UpdateLoginProfile](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateOpenIdConnectProviderThumbprint` with a CLI
The following code examples show how to use `UpdateOpenIdConnectProviderThumbprint`.
------
#### [ CLI ]
**AWS CLI**
**To replace the existing list of server certificate thumbprints with a new list**
This example updates the certificate thumbprint list for the OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com` to use a new thumbprint.
```
aws iam update-open-id-connect-provider-thumbprint \
--open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com \
--thumbprint-list 7359755EXAMPLEabc3060bce3EXAMPLEec4542a3
```
This command produces no output.
For more information, see [Creating OpenID Connect (OIDC) identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateOpenIdConnectProviderThumbprint](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-open-id-connect-provider-thumbprint.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the certificate thumbprint list for the OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com` to use a new thumbprint. The OIDC provider shares the new value when the certificate that is associated with the provider changes.**
```
Update-IAMOpenIDConnectProviderThumbprint -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com -ThumbprintList 7359755EXAMPLEabc3060bce3EXAMPLEec4542a3
```
+ For API details, see [UpdateOpenIdConnectProviderThumbprint](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the certificate thumbprint list for the OIDC provider whose ARN is `arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com` to use a new thumbprint. The OIDC provider shares the new value when the certificate that is associated with the provider changes.**
```
Update-IAMOpenIDConnectProviderThumbprint -OpenIDConnectProviderArn arn:aws:iam::123456789012:oidc-provider/example.oidcprovider.com -ThumbprintList 7359755EXAMPLEabc3060bce3EXAMPLEec4542a3
```
+ For API details, see [UpdateOpenIdConnectProviderThumbprint](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateRole` with a CLI
The following code examples show how to use `UpdateRole`.
------
#### [ CLI ]
**AWS CLI**
**To change an IAM role's description or session duration**
The following `update-role` command changes the description of the IAM role `production-role` to `Main production role` and sets the maximum session duration to 12 hours.
```
aws iam update-role \
--role-name production-role \
--description 'Main production role' \
--max-session-duration 43200
```
This command produces no output.
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateRole](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-role.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the role description and the maximum session duration value(in seconds) for which a role's session can be requested.**
```
Update-IAMRole -RoleName MyRoleName -Description "My testing role" -MaxSessionDuration 43200
```
+ For API details, see [UpdateRole](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the role description and the maximum session duration value(in seconds) for which a role's session can be requested.**
```
Update-IAMRole -RoleName MyRoleName -Description "My testing role" -MaxSessionDuration 43200
```
+ For API details, see [UpdateRole](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateRoleDescription` with a CLI
The following code examples show how to use `UpdateRoleDescription`.
------
#### [ CLI ]
**AWS CLI**
**To change an IAM role's description**
The following `update-role` command changes the description of the IAM role `production-role` to `Main production role`.
```
aws iam update-role-description \
--role-name production-role \
--description 'Main production role'
```
Output:
```
{
"Role": {
"Path": "/",
"RoleName": "production-role",
"RoleId": "AROA1234567890EXAMPLE",
"Arn": "arn:aws:iam::123456789012:role/production-role",
"CreateDate": "2017-12-06T17:16:37+00:00",
"AssumeRolePolicyDocument": {
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
},
"Description": "Main production role"
}
}
```
For more information, see [Modifying a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateRoleDescription](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-role-description.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the description of an IAM role in your account.**
```
Update-IAMRoleDescription -RoleName MyRoleName -Description "My testing role"
```
+ For API details, see [UpdateRoleDescription](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the description of an IAM role in your account.**
```
Update-IAMRoleDescription -RoleName MyRoleName -Description "My testing role"
```
+ For API details, see [UpdateRoleDescription](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateSamlProvider` with a CLI
The following code examples show how to use `UpdateSamlProvider`.
------
#### [ CLI ]
**AWS CLI**
**To update the metadata document for an existing SAML provider**
This example updates the SAML provider in IAM whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFS` with a new SAML metadata document from the file `SAMLMetaData.xml`.
```
aws iam update-saml-provider \
--saml-metadata-document file://SAMLMetaData.xml \
--saml-provider-arn arn:aws:iam::123456789012:saml-provider/SAMLADFS
```
Output:
```
{
"SAMLProviderArn": "arn:aws:iam::123456789012:saml-provider/SAMLADFS"
}
```
For more information, see [Creating IAM SAML identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateSamlProvider](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-saml-provider.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the SAML provider in IAM whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFS` with a new SAML metadata document from the file `SAMLMetaData.xml`. Note that you must use the `-Raw` switch parameter to successfully process the contents of the JSON file.**
```
Update-IAMSAMLProvider -SAMLProviderArn arn:aws:iam::123456789012:saml-provider/SAMLADFS -SAMLMetadataDocument (Get-Content -Raw SAMLMetaData.xml)
```
+ For API details, see [UpdateSamlProvider](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the SAML provider in IAM whose ARN is `arn:aws:iam::123456789012:saml-provider/SAMLADFS` with a new SAML metadata document from the file `SAMLMetaData.xml`. Note that you must use the `-Raw` switch parameter to successfully process the contents of the JSON file.**
```
Update-IAMSAMLProvider -SAMLProviderArn arn:aws:iam::123456789012:saml-provider/SAMLADFS -SAMLMetadataDocument (Get-Content -Raw SAMLMetaData.xml)
```
+ For API details, see [UpdateSamlProvider](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateServerCertificate` with an AWS SDK or CLI
The following code examples show how to use `UpdateServerCertificate`.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::updateServerCertificate(const Aws::String ¤tCertificateName,
const Aws::String &newCertificateName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::UpdateServerCertificateRequest request;
request.SetServerCertificateName(currentCertificateName);
request.SetNewServerCertificateName(newCertificateName);
auto outcome = iam.UpdateServerCertificate(request);
bool result = true;
if (outcome.IsSuccess()) {
std::cout << "Server certificate " << currentCertificateName
<< " successfully renamed as " << newCertificateName
<< std::endl;
}
else {
if (outcome.GetError().GetErrorType() != Aws::IAM::IAMErrors::NO_SUCH_ENTITY) {
std::cerr << "Error changing name of server certificate " <<
currentCertificateName << " to " << newCertificateName << ":" <<
outcome.GetError().GetMessage() << std::endl;
result = false;
}
else {
std::cout << "Certificate '" << currentCertificateName
<< "' not found." << std::endl;
}
}
return result;
}
```
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/UpdateServerCertificate) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To change the path or name of a server certificate in your AWS account**
The following `update-server-certificate` command changes the name of the certificate from `myServerCertificate` to `myUpdatedServerCertificate`. It also changes the path to `/cloudfront/` so that it can be accessed by the Amazon CloudFront service. This command produces no output. You can see the results of the update by running the `list-server-certificates` command.
```
aws-iam update-server-certificate \
--server-certificate-name myServerCertificate \
--new-server-certificate-name myUpdatedServerCertificate \
--new-path /cloudfront/
```
This command produces no output.
For more information, see [Managing server certificates in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateServerCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-server-certificate.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Update a server certificate.
```
import { UpdateServerCertificateCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} currentName
* @param {string} newName
*/
export const updateServerCertificate = (currentName, newName) => {
const command = new UpdateServerCertificateCommand({
ServerCertificateName: currentName,
NewServerCertificateName: newName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-updating).
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/UpdateServerCertificateCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
ServerCertificateName: "CERTIFICATE_NAME",
NewServerCertificateName: "NEW_CERTIFICATE_NAME",
};
iam.updateServerCertificate(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-server-certificates.html#iam-examples-server-certificates-updating).
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/UpdateServerCertificate) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example renames the certificate named `MyServerCertificate` to `MyRenamedServerCertificate`.**
```
Update-IAMServerCertificate -ServerCertificateName MyServerCertificate -NewServerCertificateName MyRenamedServerCertificate
```
**Example 2: This example moves the certificate named `MyServerCertificate` to the path /Org1/Org2/. This changes the ARN for the resource to `arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate`.**
```
Update-IAMServerCertificate -ServerCertificateName MyServerCertificate -NewPath /Org1/Org2/
```
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example renames the certificate named `MyServerCertificate` to `MyRenamedServerCertificate`.**
```
Update-IAMServerCertificate -ServerCertificateName MyServerCertificate -NewServerCertificateName MyRenamedServerCertificate
```
**Example 2: This example moves the certificate named `MyServerCertificate` to the path /Org1/Org2/. This changes the ARN for the resource to `arn:aws:iam::123456789012:server-certificate/Org1/Org2/MyServerCertificate`.**
```
Update-IAMServerCertificate -ServerCertificateName MyServerCertificate -NewPath /Org1/Org2/
```
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
List, update, and delete server certificates.
```
class ServerCertificateManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'ServerCertificateManager'
end
# Creates a new server certificate.
# @param name [String] the name of the server certificate
# @param certificate_body [String] the contents of the certificate
# @param private_key [String] the private key contents
# @return [Boolean] returns true if the certificate was successfully created
def create_server_certificate(name, certificate_body, private_key)
@iam_client.upload_server_certificate({
server_certificate_name: name,
certificate_body: certificate_body,
private_key: private_key
})
true
rescue Aws::IAM::Errors::ServiceError => e
puts "Failed to create server certificate: #{e.message}"
false
end
# Lists available server certificate names.
def list_server_certificate_names
response = @iam_client.list_server_certificates
if response.server_certificate_metadata_list.empty?
@logger.info('No server certificates found.')
return
end
response.server_certificate_metadata_list.each do |certificate_metadata|
@logger.info("Certificate Name: #{certificate_metadata.server_certificate_name}")
end
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error listing server certificates: #{e.message}")
end
# Updates the name of a server certificate.
def update_server_certificate_name(current_name, new_name)
@iam_client.update_server_certificate(
server_certificate_name: current_name,
new_server_certificate_name: new_name
)
@logger.info("Server certificate name updated from '#{current_name}' to '#{new_name}'.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error updating server certificate name: #{e.message}")
false
end
# Deletes a server certificate.
def delete_server_certificate(name)
@iam_client.delete_server_certificate(server_certificate_name: name)
@logger.info("Server certificate '#{name}' deleted.")
true
rescue Aws::IAM::Errors::ServiceError => e
@logger.error("Error deleting server certificate: #{e.message}")
false
end
end
```
+ For API details, see [UpdateServerCertificate](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/UpdateServerCertificate) in *AWS SDK for Ruby API Reference*.
------
# Use `UpdateSigningCertificate` with a CLI
The following code examples show how to use `UpdateSigningCertificate`.
------
#### [ CLI ]
**AWS CLI**
**To activate or deactivate a signing certificate for an IAM user**
The following `update-signing-certificate` command deactivates the specified signing certificate for the IAM user named `Bob`.
```
aws iam update-signing-certificate \
--certificate-id TA7SMP42TDN5Z26OBPJE7EXAMPLE \
--status Inactive \
--user-name Bob
```
To get the ID for a signing certificate, use the `list-signing-certificates` command.
For more information, see [Manage signing certificates](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-up-ami-tools.html#ami-tools-managing-certs) in the *Amazon EC2 User Guide*.
+ For API details, see [UpdateSigningCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-signing-certificate.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example updates the certificate that is associated with the IAM user named `Bob` and whose certificate ID si `Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU` to mark it as inactive.**
```
Update-IAMSigningCertificate -CertificateId Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU -UserName Bob -Status Inactive
```
+ For API details, see [UpdateSigningCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example updates the certificate that is associated with the IAM user named `Bob` and whose certificate ID si `Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU` to mark it as inactive.**
```
Update-IAMSigningCertificate -CertificateId Y3EK7RMEXAMPLESV33FCREXAMPLEMJLU -UserName Bob -Status Inactive
```
+ For API details, see [UpdateSigningCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UpdateUser` with an AWS SDK or CLI
The following code examples show how to use `UpdateUser`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code example:
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
bool AwsDoc::IAM::updateUser(const Aws::String ¤tUserName,
const Aws::String &newUserName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::UpdateUserRequest request;
request.SetUserName(currentUserName);
request.SetNewUserName(newUserName);
auto outcome = iam.UpdateUser(request);
if (outcome.IsSuccess()) {
std::cout << "IAM user " << currentUserName <<
" successfully updated with new user name " << newUserName <<
std::endl;
}
else {
std::cerr << "Error updating user name for IAM user " << currentUserName <<
":" << outcome.GetError().GetMessage() << std::endl;
}
return outcome.IsSuccess();
}
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/goto/SdkForCpp/iam-2010-05-08/UpdateUser) in *AWS SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**AWS CLI**
**To change an IAM user's name**
The following `update-user` command changes the name of the IAM user `Bob` to `Robert`.
```
aws iam update-user \
--user-name Bob \
--new-user-name Robert
```
This command produces no output.
For more information, see [Renaming an IAM user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_rename.html) in the *AWS IAM User Guide*.
+ For API details, see [UpdateUser](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-user.html) in *AWS CLI Command Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
import software.amazon.awssdk.services.iam.model.UpdateUserRequest;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class UpdateUser {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
curName - The current user name.\s
newName - An updated user name.\s
""";
if (args.length != 2) {
System.out.println(usage);
System.exit(1);
}
String curName = args[0];
String newName = args[1];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
updateIAMUser(iam, curName, newName);
System.out.println("Done");
iam.close();
}
public static void updateIAMUser(IamClient iam, String curName, String newName) {
try {
UpdateUserRequest request = UpdateUserRequest.builder()
.userName(curName)
.newUserName(newName)
.build();
iam.updateUser(request);
System.out.printf("Successfully updated user to username %s", newName);
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
}
}
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/goto/SdkForJavaV2/iam-2010-05-08/UpdateUser) in *AWS SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Update the user.
```
import { UpdateUserCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} currentUserName
* @param {string} newUserName
*/
export const updateUser = (currentUserName, newUserName) => {
const command = new UpdateUserCommand({
UserName: currentUserName,
NewUserName: newUserName,
});
return client.send(command);
};
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-updating-users).
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/UpdateUserCommand) in *AWS SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
var params = {
UserName: process.argv[2],
NewUserName: process.argv[3],
};
iam.updateUser(params, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data);
}
});
```
+ For more information, see [AWS SDK for JavaScript Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-managing-users.html#iam-examples-managing-users-updating-users).
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/iam-2010-05-08/UpdateUser) in *AWS SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun updateIAMUser(
curName: String?,
newName: String?,
) {
val request =
UpdateUserRequest {
userName = curName
newUserName = newName
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
iamClient.updateUser(request)
println("Successfully updated user to $newName")
}
}
```
+ For API details, see [UpdateUser](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *AWS SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example renames the IAM user `Bob` to `Robert`.**
```
Update-IAMUser -UserName Bob -NewUserName Robert
```
**Example 2: This example changes the path of the IAM User `Bob` to `/Org1/Org2/`, which effectively changes the ARN for the user to `arn:aws:iam::123456789012:user/Org1/Org2/bob`.**
```
Update-IAMUser -UserName Bob -NewPath /Org1/Org2/
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example renames the IAM user `Bob` to `Robert`.**
```
Update-IAMUser -UserName Bob -NewUserName Robert
```
**Example 2: This example changes the path of the IAM User `Bob` to `/Org1/Org2/`, which effectively changes the ARN for the user to `arn:aws:iam::123456789012:user/Org1/Org2/bob`.**
```
Update-IAMUser -UserName Bob -NewPath /Org1/Org2/
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def update_user(user_name, new_user_name):
"""
Updates a user's name.
:param user_name: The current name of the user to update.
:param new_user_name: The new name to assign to the user.
:return: The updated user.
"""
try:
user = iam.User(user_name)
user.update(NewUserName=new_user_name)
logger.info("Renamed %s to %s.", user_name, new_user_name)
except ClientError:
logger.exception("Couldn't update name for user %s.", user_name)
raise
return user
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/goto/boto3/iam-2010-05-08/UpdateUser) in *AWS SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
```
# Updates an IAM user's name
#
# @param current_name [String] The current name of the user
# @param new_name [String] The new name of the user
def update_user_name(current_name, new_name)
@iam_client.update_user(user_name: current_name, new_user_name: new_name)
true
rescue StandardError => e
@logger.error("Error updating user name from '#{current_name}' to '#{new_name}': #{e.message}")
false
end
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/goto/SdkForRubyV3/iam-2010-05-08/UpdateUser) in *AWS SDK for Ruby API Reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
lo_iam->updateuser(
iv_username = iv_user_name
iv_newusername = iv_new_user_name ).
MESSAGE 'User updated successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamentityalrdyexex.
MESSAGE 'New user name already exists.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [UpdateUser](https://docs.aws.amazon.com/sdk-for-sap-abap/v1/api/latest/index.html) in *AWS SDK for SAP ABAP API reference*.
------
# Use `UploadServerCertificate` with an AWS SDK or CLI
The following code examples show how to use `UploadServerCertificate`.
------
#### [ CLI ]
**AWS CLI**
**To upload a server certificate to your AWS account**
The following **upload-server-certificate** command uploads a server certificate to your AWS account. In this example, the certificate is in the file `public_key_cert_file.pem`, the associated private key is in the file `my_private_key.pem`, and the the certificate chain provided by the certificate authority (CA) is in the `my_certificate_chain_file.pem` file. When the file has finished uploading, it is available under the name *myServerCertificate*. Parameters that begin with `file://` tells the command to read the contents of the file and use that as the parameter value instead of the file name itself.
```
aws iam upload-server-certificate \
--server-certificate-name myServerCertificate \
--certificate-body file://public_key_cert_file.pem \
--private-key file://my_private_key.pem \
--certificate-chain file://my_certificate_chain_file.pem
```
Output:
```
{
"ServerCertificateMetadata": {
"Path": "/",
"ServerCertificateName": "myServerCertificate",
"ServerCertificateId": "ASCAEXAMPLE123EXAMPLE",
"Arn": "arn:aws:iam::1234567989012:server-certificate/myServerCertificate",
"UploadDate": "2019-04-22T21:13:44+00:00",
"Expiration": "2019-10-15T22:23:16+00:00"
}
}
```
For more information, see Creating, Uploading, and Deleting Server Certificates in the *Using IAM* guide.
+ For API details, see [UploadServerCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/upload-server-certificate.html) in *AWS CLI Command Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [AWS Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
```
import { UploadServerCertificateCommand, IAMClient } from "@aws-sdk/client-iam";
import { readFileSync } from "node:fs";
import { dirnameFromMetaUrl } from "@aws-doc-sdk-examples/lib/utils/util-fs.js";
import * as path from "node:path";
const client = new IAMClient({});
const certMessage = `Generate a certificate and key with the following command, or the equivalent for your system.
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-keyout example.key -out example.crt -subj "/CN=example.com" \
-addext "subjectAltName=DNS:example.com,DNS:www.example.net,IP:10.0.0.1"
`;
const getCertAndKey = () => {
try {
const cert = readFileSync(
path.join(dirnameFromMetaUrl(import.meta.url), "./example.crt"),
);
const key = readFileSync(
path.join(dirnameFromMetaUrl(import.meta.url), "./example.key"),
);
return { cert, key };
} catch (err) {
if (err.code === "ENOENT") {
throw new Error(
`Certificate and/or private key not found. ${certMessage}`,
);
}
throw err;
}
};
/**
*
* @param {string} certificateName
*/
export const uploadServerCertificate = (certificateName) => {
const { cert, key } = getCertAndKey();
const command = new UploadServerCertificateCommand({
ServerCertificateName: certificateName,
CertificateBody: cert.toString(),
PrivateKey: key.toString(),
});
return client.send(command);
};
```
+ For API details, see [UploadServerCertificate](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/iam/command/UploadServerCertificateCommand) in *AWS SDK for JavaScript API Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example uploads a new server certificate to the IAM account. The files containing the certificate body, the private key, and (optionally) the certificate chain must all be PEM encoded. Note that the parameters require the actual content of the files rather than the file names. You must use the `-Raw` switch parameter to successfully process the file contents. **
```
Publish-IAMServerCertificate -ServerCertificateName MyTestCert -CertificateBody (Get-Content -Raw server.crt) -PrivateKey (Get-Content -Raw server.key)
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/MyTestCert
Expiration : 1/14/2018 9:52:36 AM
Path : /
ServerCertificateId : ASCAJIEXAMPLE7J7HQZYW
ServerCertificateName : MyTestCert
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [UploadServerCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example uploads a new server certificate to the IAM account. The files containing the certificate body, the private key, and (optionally) the certificate chain must all be PEM encoded. Note that the parameters require the actual content of the files rather than the file names. You must use the `-Raw` switch parameter to successfully process the file contents. **
```
Publish-IAMServerCertificate -ServerCertificateName MyTestCert -CertificateBody (Get-Content -Raw server.crt) -PrivateKey (Get-Content -Raw server.key)
```
**Output:**
```
Arn : arn:aws:iam::123456789012:server-certificate/MyTestCert
Expiration : 1/14/2018 9:52:36 AM
Path : /
ServerCertificateId : ASCAJIEXAMPLE7J7HQZYW
ServerCertificateName : MyTestCert
UploadDate : 4/21/2015 11:14:16 AM
```
+ For API details, see [UploadServerCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------
# Use `UploadSigningCertificate` with a CLI
The following code examples show how to use `UploadSigningCertificate`.
------
#### [ CLI ]
**AWS CLI**
**To upload a signing certificate for an IAM user**
The following `upload-signing-certificate` command uploads a signing certificate for the IAM user named `Bob`.
```
aws iam upload-signing-certificate \
--user-name Bob \
--certificate-body file://certificate.pem
```
Output:
```
{
"Certificate": {
"UserName": "Bob",
"Status": "Active",
"CertificateBody": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----",
"CertificateId": "TA7SMP42TDN5Z26OBPJE7EXAMPLE",
"UploadDate": "2013-06-06T21:40:08.121Z"
}
}
```
The certificate is in a file named *certificate.pem* in PEM format.
For more information, see Creating and Uploading a User Signing Certificate in the *Using IAM* guide.
+ For API details, see [UploadSigningCertificate](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/upload-signing-certificate.html) in *AWS CLI Command Reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example uploads a new X.509 signing certificate and associates it with the IAM user named `Bob`. The file containing the certificate body is PEM encoded. The `CertificateBody` parameter requires the actual contents of the certificate file rather than the file name. You must use the `-Raw` switch parameter to successfully process the file.**
```
Publish-IAMSigningCertificate -UserName Bob -CertificateBody (Get-Content -Raw SampleSigningCert.pem)
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateId : Y3EK7RMEXAMPLESV33FCEXAMPLEHMJLU
Status : Active
UploadDate : 4/20/2015 1:26:01 PM
UserName : Bob
```
+ For API details, see [UploadSigningCertificate](https://docs.aws.amazon.com/powershell/v4/reference) in *AWS Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example uploads a new X.509 signing certificate and associates it with the IAM user named `Bob`. The file containing the certificate body is PEM encoded. The `CertificateBody` parameter requires the actual contents of the certificate file rather than the file name. You must use the `-Raw` switch parameter to successfully process the file.**
```
Publish-IAMSigningCertificate -UserName Bob -CertificateBody (Get-Content -Raw SampleSigningCert.pem)
```
**Output:**
```
CertificateBody : -----BEGIN CERTIFICATE-----
MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
-----END CERTIFICATE-----
CertificateId : Y3EK7RMEXAMPLESV33FCEXAMPLEHMJLU
Status : Active
UploadDate : 4/20/2015 1:26:01 PM
UserName : Bob
```
+ For API details, see [UploadSigningCertificate](https://docs.aws.amazon.com/powershell/v5/reference) in *AWS Tools for PowerShell Cmdlet Reference (V5)*.
------