AWS IAM

AWS Identity and Access Management (IAM) controls access to AWS resources. Use this integration to manage users, roles, policies, groups, and access keys, or simulate a principal’s permissions before changing them.

Simulate Principal Policy returns one result per action regardless of how many resource ARNs you pass. The top-level decision is the aggregate across every resource — most restrictive wins — and the top-level resource name is an ARN template for the resource type, not one of your ARNs. Per-resource answers live in resourceSpecificResults, and when you supply concrete ARNs, missing context keys are reported there too rather than at the top level. Read resourceSpecificResults whenever you simulate against more than one resource: the aggregate alone will tell you a principal is denied when it is in fact allowed on some of them.

The secret half of a new access key is returned once and is hidden from block output display and execution logs. It stays resolvable downstream, so rotation workflows can pass it straight to the system that needs it — but a block you pass it into will log it under that block's own inputs.

Use the block

Create and manage users, roles, policies, groups, and access keys.

Actions

IAM List Users

List IAM users in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`pathPrefix`	string	No	Path prefix to filter users (e.g., /division_abc/)
`maxItems`	number	No	Maximum number of users to return (1-1000, default 100)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`users`	json	List of IAM users with userName, userId, arn, path, and dates
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of users returned

IAM Get User

Get detailed information about an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	No	The name of the IAM user to retrieve (defaults to the caller if omitted)

Output

Parameter	Type	Description
`userName`	string	The name of the user
`userId`	string	The unique ID of the user
`arn`	string	The ARN of the user
`path`	string	The path to the user
`createDate`	string	Date the user was created
`passwordLastUsed`	string	Date the password was last used
`permissionsBoundaryArn`	string	ARN of the permissions boundary policy
`tags`	json	Tags attached to the user (key, value pairs)

IAM Create User

Create a new IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	Name for the new IAM user (1-64 characters)
`path`	string	No	Path for the user (e.g., /division_abc/), defaults to /

Output

Parameter	Type	Description
`message`	string	Operation status message
`userName`	string	The name of the created user
`userId`	string	The unique ID of the created user
`arn`	string	The ARN of the created user
`path`	string	The path of the created user
`createDate`	string	Date the user was created

IAM Delete User

Delete an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	The name of the IAM user to delete

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM List Roles

List IAM roles in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`pathPrefix`	string	No	Path prefix to filter roles (e.g., /application/)
`maxItems`	number	No	Maximum number of roles to return (1-1000, default 100)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`roles`	json	List of IAM roles with roleName, roleId, arn, path, and dates
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of roles returned

IAM Get Role

Get detailed information about an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	The name of the IAM role to retrieve

Output

Parameter	Type	Description
`roleName`	string	The name of the role
`roleId`	string	The unique ID of the role
`arn`	string	The ARN of the role
`path`	string	The path to the role
`createDate`	string	Date the role was created
`description`	string	Description of the role
`maxSessionDuration`	number	Maximum session duration in seconds
`assumeRolePolicyDocument`	string	The trust policy document (JSON)
`roleLastUsedDate`	string	Date the role was last used
`roleLastUsedRegion`	string	AWS region where the role was last used

IAM Create Role

Create a new IAM role with a trust policy

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	Name for the new IAM role (1-64 characters)
`assumeRolePolicyDocument`	string	Yes	Trust policy JSON specifying who can assume this role
`description`	string	No	Description of the role
`path`	string	No	Path for the role (e.g., /application/), defaults to /
`maxSessionDuration`	number	No	Maximum session duration in seconds (3600-43200, default 3600)

Output

Parameter	Type	Description
`message`	string	Operation status message
`roleName`	string	The name of the created role
`roleId`	string	The unique ID of the created role
`arn`	string	The ARN of the created role
`path`	string	The path of the created role
`createDate`	string	Date the role was created

IAM Delete Role

Delete an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	The name of the IAM role to delete

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM Attach User Policy

Attach a managed policy to an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	The name of the IAM user
`policyArn`	string	Yes	The ARN of the managed policy to attach

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM Detach User Policy

Remove a managed policy from an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	The name of the IAM user
`policyArn`	string	Yes	The ARN of the managed policy to detach

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM Attach Role Policy

Attach a managed policy to an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	The name of the IAM role
`policyArn`	string	Yes	The ARN of the managed policy to attach

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM Detach Role Policy

Remove a managed policy from an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	The name of the IAM role
`policyArn`	string	Yes	The ARN of the managed policy to detach

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM List Policies

List managed IAM policies

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`scope`	string	No	Filter by scope. Must be exactly one of: All, AWS (AWS-managed), Local (customer-managed)
`onlyAttached`	boolean	No	If true, only return policies attached to an entity
`pathPrefix`	string	No	Path prefix to filter policies
`maxItems`	number	No	Maximum number of policies to return (1-1000, default 100)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`policies`	json	List of policies with policyName, policyId, arn, path, attachmentCount, isAttachable, defaultVersionId, permissionsBoundaryUsageCount, and dates. AWS never returns policy descriptions from ListPolicies — use IAM Get Policy for a description.
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of policies returned

IAM Get Policy

Get details about a managed IAM policy, including its description — the field ListPolicies never returns

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`policyArn`	string	Yes	ARN of the managed policy to retrieve (e.g., arn:aws:iam::aws:policy/ReadOnlyAccess)

Output

Parameter	Type	Description
`policyName`	string	The friendly name of the policy
`policyId`	string	The stable unique ID of the policy
`arn`	string	The ARN of the policy
`path`	string	The path to the policy
`attachmentCount`	number	Number of entities the policy is attached to
`isAttachable`	boolean	Whether the policy can be attached
`createDate`	string	Date the policy was created
`updateDate`	string	Date the policy was last updated
`description`	string	The policy description
`defaultVersionId`	string	The identifier of the default policy version
`permissionsBoundaryUsageCount`	number	Number of entities using the policy as a permissions boundary
`tags`	json	Tags attached to the policy (key, value pairs)

IAM Create Access Key

Create a new access key pair for an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	No	The IAM user to create the key for (defaults to current user)

Output

Parameter	Type	Description
`message`	string	Operation status message
`accessKeyId`	string	The new access key ID
`secretAccessKey`	string	The new secret access key (only shown once)
`userName`	string	The user the key was created for
`status`	string	Status of the access key (Active)
`createDate`	string	Date the key was created

IAM Delete Access Key

Delete an access key pair for an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`accessKeyIdToDelete`	string	Yes	The access key ID to delete
`userName`	string	No	The IAM user whose key to delete (defaults to current user)

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM List Access Keys

List an IAM user's access key IDs with their status and age — use to find stale keys and to confirm which keys remain after a rotation

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	No	The IAM user whose keys to list (defaults to the calling user if omitted)
`maxItems`	number	No	Maximum number of access keys to return (1-1000)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`accessKeys`	json	Access key metadata: accessKeyId, userName, status (Active/Inactive), createDate. The secret access key is never returned by this operation.
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of access keys returned

IAM Update Access Key

Activate or deactivate an IAM access key — deactivate an old key and verify nothing breaks before deleting it

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`accessKeyIdToUpdate`	string	Yes	The access key ID whose status to change
`status`	string	Yes	The status to set. Must be exactly one of: Active, Inactive. An Inactive key is rejected by AWS but can be reactivated.
`userName`	string	No	The IAM user that owns the key (defaults to the calling user if omitted)

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM List Groups

List IAM groups in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`pathPrefix`	string	No	Path prefix to filter groups
`maxItems`	number	No	Maximum number of groups to return (1-1000, default 100)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`groups`	json	List of IAM groups with groupName, groupId, arn, and path
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of groups returned

IAM Add User to Group

Add an IAM user to a group

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	The name of the IAM user
`groupName`	string	Yes	The name of the IAM group

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM Remove User from Group

Remove an IAM user from a group

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	The name of the IAM user
`groupName`	string	Yes	The name of the IAM group

Output

Parameter	Type	Description
`message`	string	Operation status message

IAM List Attached Role Policies

List all managed policies attached to an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`roleName`	string	Yes	Name of the IAM role
`pathPrefix`	string	No	Path prefix to filter policies (e.g., /application/)
`maxItems`	number	No	Maximum number of policies to return (1-1000)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`attachedPolicies`	json	List of attached policies with policyName and policyArn
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of attached policies returned

IAM List Attached User Policies

List all managed policies attached to an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`userName`	string	Yes	Name of the IAM user
`pathPrefix`	string	No	Path prefix to filter policies (e.g., /application/)
`maxItems`	number	No	Maximum number of policies to return (1-1000)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`attachedPolicies`	json	List of attached policies with policyName and policyArn
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of attached policies returned

IAM Simulate Principal Policy

Simulate whether a user, role, or group is allowed to perform specific AWS actions — useful for pre-flight access checks

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`policySourceArn`	string	Yes	ARN of the user, group, or role to simulate (e.g., arn:aws:iam::123456789012:user/alice)
`actionNames`	string	Yes	Comma-separated list of AWS actions to simulate (e.g., s3:GetObject,ec2:DescribeInstances)
`resourceArns`	string	No	Comma-separated list of resource ARNs to simulate against (defaults to * if not provided). Read the per-ARN verdict from resourceSpecificResults, not from evalDecision.
`contextEntries`	array	No	Condition context keys to supply to the simulation. Without these, any policy gated by a Condition simulates as denied with missing context values.
`maxResults`	number	No	Maximum number of simulation results to return (1-1000)
`marker`	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
`evaluationResults`	json	One result per simulated action. evalDecision is the AGGREGATE, most-restrictive decision across every resource ARN, and evalResourceName is the resource-type ARN template (e.g. an arn:aws:s3:::BUCKET/KEY shape with the bucket and key left as placeholders), not a customer ARN. For the verdict on an individual ARN read resourceSpecificResults[]: evalResourceName, evalResourceDecision (allowed/explicitDeny/implicitDeny), matchedStatements, missingContextValues, permissionsBoundaryAllowed. When concrete resource ARNs are supplied, missing context values appear there rather than at the top level.
`isTruncated`	boolean	Whether there are more results available
`marker`	string	Pagination marker for the next page of results
`count`	number	Number of evaluation results returned