AWS IAM

AWS Identity and Access Management (IAM) controls access to AWS resources. Use this integration to manage users, roles, policies, groups, and access keys, or simulate a principal’s permissions before changing them.

Simulate Principal Policy returns one result per action regardless of how many resource ARNs you pass. The top-level decision is the aggregate across every resource — most restrictive wins — and the top-level resource name is an ARN template for the resource type, not one of your ARNs. Per-resource answers live in resourceSpecificResults, and when you supply concrete ARNs, missing context keys are reported there too rather than at the top level. Read resourceSpecificResults whenever you simulate against more than one resource: the aggregate alone will tell you a principal is denied when it is in fact allowed on some of them.

The secret half of a new access key is returned once and is hidden from block output display and execution logs. It stays resolvable downstream, so rotation workflows can pass it straight to the system that needs it — but a block you pass it into will log it under that block's own inputs.

Use the block

Create and manage users, roles, policies, groups, and access keys.

Actions

IAM List Users

List IAM users in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
pathPrefix	string	No	Path prefix to filter users (e.g., /division_abc/)
maxItems	number	No	Maximum number of users to return (1-1000, default 100)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
users	json	List of IAM users with userName, userId, arn, path, and dates
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of users returned

IAM Get User

Get detailed information about an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	No	The name of the IAM user to retrieve (defaults to the caller if omitted)

Output

Parameter	Type	Description
userName	string	The name of the user
userId	string	The unique ID of the user
arn	string	The ARN of the user
path	string	The path to the user
createDate	string	Date the user was created
passwordLastUsed	string	Date the password was last used
permissionsBoundaryArn	string	ARN of the permissions boundary policy
tags	json	Tags attached to the user (key, value pairs)

IAM Create User

Create a new IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	Name for the new IAM user (1-64 characters)
path	string	No	Path for the user (e.g., /division_abc/), defaults to /

Output

Parameter	Type	Description
message	string	Operation status message
userName	string	The name of the created user
userId	string	The unique ID of the created user
arn	string	The ARN of the created user
path	string	The path of the created user
createDate	string	Date the user was created

IAM Delete User

Delete an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	The name of the IAM user to delete

Output

Parameter	Type	Description
message	string	Operation status message

IAM List Roles

List IAM roles in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
pathPrefix	string	No	Path prefix to filter roles (e.g., /application/)
maxItems	number	No	Maximum number of roles to return (1-1000, default 100)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
roles	json	List of IAM roles with roleName, roleId, arn, path, and dates
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of roles returned

IAM Get Role

Get detailed information about an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	The name of the IAM role to retrieve

Output

Parameter	Type	Description
roleName	string	The name of the role
roleId	string	The unique ID of the role
arn	string	The ARN of the role
path	string	The path to the role
createDate	string	Date the role was created
description	string	Description of the role
maxSessionDuration	number	Maximum session duration in seconds
assumeRolePolicyDocument	string	The trust policy document (JSON)
roleLastUsedDate	string	Date the role was last used
roleLastUsedRegion	string	AWS region where the role was last used

IAM Create Role

Create a new IAM role with a trust policy

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	Name for the new IAM role (1-64 characters)
assumeRolePolicyDocument	string	Yes	Trust policy JSON specifying who can assume this role
description	string	No	Description of the role
path	string	No	Path for the role (e.g., /application/), defaults to /
maxSessionDuration	number	No	Maximum session duration in seconds (3600-43200, default 3600)

Output

Parameter	Type	Description
message	string	Operation status message
roleName	string	The name of the created role
roleId	string	The unique ID of the created role
arn	string	The ARN of the created role
path	string	The path of the created role
createDate	string	Date the role was created

IAM Delete Role

Delete an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	The name of the IAM role to delete

Output

Parameter	Type	Description
message	string	Operation status message

IAM Attach User Policy

Attach a managed policy to an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	The name of the IAM user
policyArn	string	Yes	The ARN of the managed policy to attach

Output

Parameter	Type	Description
message	string	Operation status message

IAM Detach User Policy

Remove a managed policy from an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	The name of the IAM user
policyArn	string	Yes	The ARN of the managed policy to detach

Output

Parameter	Type	Description
message	string	Operation status message

IAM Attach Role Policy

Attach a managed policy to an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	The name of the IAM role
policyArn	string	Yes	The ARN of the managed policy to attach

Output

Parameter	Type	Description
message	string	Operation status message

IAM Detach Role Policy

Remove a managed policy from an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	The name of the IAM role
policyArn	string	Yes	The ARN of the managed policy to detach

Output

Parameter	Type	Description
message	string	Operation status message

IAM List Policies

List managed IAM policies

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
scope	string	No	Filter by scope. Must be exactly one of: All, AWS (AWS-managed), Local (customer-managed)
onlyAttached	boolean	No	If true, only return policies attached to an entity
pathPrefix	string	No	Path prefix to filter policies
maxItems	number	No	Maximum number of policies to return (1-1000, default 100)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
policies	json	List of policies with policyName, policyId, arn, path, attachmentCount, isAttachable, defaultVersionId, permissionsBoundaryUsageCount, and dates. AWS never returns policy descriptions from ListPolicies — use IAM Get Policy for a description.
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of policies returned

IAM Get Policy

Get details about a managed IAM policy, including its description — the field ListPolicies never returns

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
policyArn	string	Yes	ARN of the managed policy to retrieve (e.g., arn:aws:iam::aws:policy/ReadOnlyAccess)

Output

Parameter	Type	Description
policyName	string	The friendly name of the policy
policyId	string	The stable unique ID of the policy
arn	string	The ARN of the policy
path	string	The path to the policy
attachmentCount	number	Number of entities the policy is attached to
isAttachable	boolean	Whether the policy can be attached
createDate	string	Date the policy was created
updateDate	string	Date the policy was last updated
description	string	The policy description
defaultVersionId	string	The identifier of the default policy version
permissionsBoundaryUsageCount	number	Number of entities using the policy as a permissions boundary
tags	json	Tags attached to the policy (key, value pairs)

IAM Create Access Key

Create a new access key pair for an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	No	The IAM user to create the key for (defaults to current user)

Output

Parameter	Type	Description
message	string	Operation status message
accessKeyId	string	The new access key ID
secretAccessKey	string	The new secret access key (only shown once)
userName	string	The user the key was created for
status	string	Status of the access key (Active)
createDate	string	Date the key was created

IAM Delete Access Key

Delete an access key pair for an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
accessKeyIdToDelete	string	Yes	The access key ID to delete
userName	string	No	The IAM user whose key to delete (defaults to current user)

Output

Parameter	Type	Description
message	string	Operation status message

IAM List Access Keys

List an IAM user's access key IDs with their status and age — use to find stale keys and to confirm which keys remain after a rotation

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	No	The IAM user whose keys to list (defaults to the calling user if omitted)
maxItems	number	No	Maximum number of access keys to return (1-1000)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
accessKeys	json	Access key metadata: accessKeyId, userName, status (Active/Inactive), createDate. The secret access key is never returned by this operation.
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of access keys returned

IAM Update Access Key

Activate or deactivate an IAM access key — deactivate an old key and verify nothing breaks before deleting it

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
accessKeyIdToUpdate	string	Yes	The access key ID whose status to change
status	string	Yes	The status to set. Must be exactly one of: Active, Inactive. An Inactive key is rejected by AWS but can be reactivated.
userName	string	No	The IAM user that owns the key (defaults to the calling user if omitted)

Output

Parameter	Type	Description
message	string	Operation status message

IAM List Groups

List IAM groups in your AWS account

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
pathPrefix	string	No	Path prefix to filter groups
maxItems	number	No	Maximum number of groups to return (1-1000, default 100)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
groups	json	List of IAM groups with groupName, groupId, arn, and path
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of groups returned

IAM Add User to Group

Add an IAM user to a group

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	The name of the IAM user
groupName	string	Yes	The name of the IAM group

Output

Parameter	Type	Description
message	string	Operation status message

IAM Remove User from Group

Remove an IAM user from a group

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	The name of the IAM user
groupName	string	Yes	The name of the IAM group

Output

Parameter	Type	Description
message	string	Operation status message

IAM List Attached Role Policies

List all managed policies attached to an IAM role

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
roleName	string	Yes	Name of the IAM role
pathPrefix	string	No	Path prefix to filter policies (e.g., /application/)
maxItems	number	No	Maximum number of policies to return (1-1000)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
attachedPolicies	json	List of attached policies with policyName and policyArn
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of attached policies returned

IAM List Attached User Policies

List all managed policies attached to an IAM user

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
userName	string	Yes	Name of the IAM user
pathPrefix	string	No	Path prefix to filter policies (e.g., /application/)
maxItems	number	No	Maximum number of policies to return (1-1000)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
attachedPolicies	json	List of attached policies with policyName and policyArn
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of attached policies returned

IAM Simulate Principal Policy

Simulate whether a user, role, or group is allowed to perform specific AWS actions — useful for pre-flight access checks

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
policySourceArn	string	Yes	ARN of the user, group, or role to simulate (e.g., arn:aws:iam::123456789012:user/alice)
actionNames	string	Yes	Comma-separated list of AWS actions to simulate (e.g., s3:GetObject,ec2:DescribeInstances)
resourceArns	string	No	Comma-separated list of resource ARNs to simulate against (defaults to * if not provided). Read the per-ARN verdict from resourceSpecificResults, not from evalDecision.
contextEntries	array	No	Condition context keys to supply to the simulation. Without these, any policy gated by a Condition simulates as denied with missing context values.
maxResults	number	No	Maximum number of simulation results to return (1-1000)
marker	string	No	Pagination marker from a previous request

Output

Parameter	Type	Description
evaluationResults	json	One result per simulated action. evalDecision is the AGGREGATE, most-restrictive decision across every resource ARN, and evalResourceName is the resource-type ARN template (e.g. an arn:aws:s3:::BUCKET/KEY shape with the bucket and key left as placeholders), not a customer ARN. For the verdict on an individual ARN read resourceSpecificResults[]: evalResourceName, evalResourceDecision (allowed/explicitDeny/implicitDeny), matchedStatements, missingContextValues, permissionsBoundaryAllowed. When concrete resource ARNs are supplied, missing context values appear there rather than at the top level.
isTruncated	boolean	Whether there are more results available
marker	string	Pagination marker for the next page of results
count	number	Number of evaluation results returned