Skip to content

IAM

Installation

To install the IAM client:

python -m pip install aws-sdk-iam

Client

AsyncIAMClient

Bases: AsyncClient[AsyncIAMConfig]

Identity and Access Management (IAM) is a web service for securely controlling access to Amazon Web Services services. With IAM, you can centrally manage users, security credentials such as access keys, and permissions that control which Amazon Web Services resources users and applications can access. For more information about IAM, see Identity and Access Management (IAM) and the Identity and Access Management User Guide.

Programmatic access to IAM

We recommend that you use the Amazon Web Services SDKs to make programmatic API calls to IAM. The Amazon Web Services SDKs consist of libraries and sample code for various programming languages and platforms (for example, Java, Ruby, .NET, iOS, and Android). The SDKs provide a convenient way to create programmatic access to IAM and Amazon Web Services. For example, the SDKs take care of tasks such as cryptographically signing requests, managing errors, and retrying requests automatically. For more information, see Tools to build on Amazon Web Services.

Alternatively, you can also use the IAM Query API to make direct calls to the IAM service. For more information about calling the IAM Query API, see Making query requests in the Identity and Access Management User Guide. IAM supports GET and POST requests for all actions. That is, the API does not require you to use GET for some actions and POST for others. However, GET requests are subject to the limitation size of a URL. Therefore, for operations that require larger sizes, use a POST request.

Signing requests

Requests must be signed using an access key ID and a secret access key. We strongly recommend that you do not use your Amazon Web Services account access key ID and secret access key for everyday work with IAM. You can use the access key ID and secret access key for an IAM user or you can use the Security Token Service to generate temporary security credentials and use those to sign requests.

To sign requests, we recommend that you use Signature Version 4. If you have an existing application that uses Signature Version 2, you do not have to update it to use Signature Version 4. However, some operations now require Signature Version 4. The documentation for operations that require version 4 indicate this requirement.

Additional resources

Operations

Configuration

AsyncIAMConfig dataclass 

AsyncIAMConfig()

Bases: AsyncAwsConfig

IAM configuration (async-resolved).

Attributes

auth_scheme_resolver class-attribute instance-attribute 
auth_scheme_resolver: AuthSchemeResolver | None = None

An auth scheme resolver that determines the auth scheme for each operation.

auth_schemes class-attribute instance-attribute 
auth_schemes: dict[ShapeID, AsyncAuthScheme[Any, Any, Any, Any]] | None = None

A map of auth scheme ids to auth schemes.

aws_access_key_id class-attribute instance-attribute 
aws_access_key_id: str | None = None

The identifier for a secret access key.

aws_credentials_identity_resolver class-attribute instance-attribute 
aws_credentials_identity_resolver: AsyncIdentityResolver[AWSCredentialsIdentity, AWSIdentityProperties] | None = None

Resolves AWS Credentials. Required for operations that use Sigv4 Auth.

aws_secret_access_key class-attribute instance-attribute 
aws_secret_access_key: str | None = None

A secret access key that can be used to sign requests.

aws_session_token class-attribute instance-attribute 
aws_session_token: str | None = None

The session token used with temporary AWS credentials.

endpoint_resolver class-attribute instance-attribute 
endpoint_resolver: EndpointResolver | AsyncEndpointResolver | None = None

The endpoint resolver used to resolve the final endpoint per-operation based on the configuration.

interceptors class-attribute instance-attribute 
interceptors: list[_ServiceInterceptor] = field(default_factory=lambda: [])

The list of interceptors, which are hooks that are called during the execution of a request.

protocol class-attribute instance-attribute 
protocol: ClientProtocol[Any, Any] | None = None

Pass a protocol class reference from smithy_aws_core.aio.protocols to select the protocol, e.g. protocol=AsyncAwsJson10ClientProtocol. For custom protocols a protocol instance may also be passed.

region class-attribute instance-attribute 
region: str | None = None

The AWS region to connect to. The configured region is used to determine the service endpoint.

sdk_ua_app_id class-attribute instance-attribute 
sdk_ua_app_id: str | None = None

A unique and opaque application ID that is appended to the User-Agent header.

use_dualstack_endpoint class-attribute instance-attribute 
use_dualstack_endpoint: bool | None = None

When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.

use_fips_endpoint class-attribute instance-attribute 
use_fips_endpoint: bool | None = None

When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.

user_agent_extra class-attribute instance-attribute 
user_agent_extra: str | None = None

Additional suffix to be added to the User-Agent header.

Methods:

resolve async classmethod 
resolve(*, profile: str | None = None, fs: AsyncFileSystem | None = None, config_file_path: str | None = None, credentials_file_path: str | None = None, **overrides: Unpack[_AsyncIAMConfigOverrides]) -> Self

Resolve config from environment, config files, defaults, and explicit overrides.

set_auth_scheme 
set_auth_scheme(scheme: AsyncAuthScheme[Any, Any, Any, Any]) -> None

Set an auth scheme implementation using its scheme ID. :param scheme: The auth scheme to add or replace.

Plugin module-attribute 

Plugin: TypeAlias = Callable[[AsyncIAMConfig], None]

A callable that customizes a client configuration. Service-level plugins are applied once to the base configuration inherited by every operation. Operation-level plugins apply only to a single operation invocation.

Structures

Errors

Unions

Enums