2026/08/12 - AWS Identity and Access Management - 4 new10 updated api methods
Changes Introduced role manager, an IAM capability that automatically sets up the IAM roles your AWS services need. When you set up a supported service in the console, role manager creates a role for you or reuses an existing one from an AWS-managed template.
Sets account-level properties for the caller's Amazon Web Services account. Account properties are configuration settings that control account-wide IAM features such as Role Manager.
Specify properties as key-value pairs in Namespace/PropertyName format. All properties in a single request must belong to the same namespace. Use GetAccountProperties to view the current properties.
See also: AWS API Documentation
Request Syntax
client.put_account_properties(
Properties={
'string': 'string'
}
)
dict
[REQUIRED]
A map of property key-value pairs to set. All keys must belong to the same namespace.
Each key uses the format Namespace/PropertyName. The key must contain exactly one / separating the namespace from the property name, and cannot start or end with /.
The service validates each value based on the property key's expected type. For example, boolean properties expect true or false.
(string) --
(string) -- String representation of the property value. The service will validate and coerce the value based on the property key's expected type. For example, integer properties expect numeric strings, and boolean properties expect "true" or "false".
dict
Response Syntax
{}
Response Structure
(dict) --
Retrieves the account-level properties for the caller's Amazon Web Services account. Account properties are configuration settings that control account-wide IAM features such as Role Manager.
The service returns properties as key-value pairs in Namespace/PropertyName format. Each namespace groups related configuration settings. Use PutAccountProperties to modify these properties.
See also: AWS API Documentation
Request Syntax
client.get_account_properties()
dict
Response Syntax
{
'Properties': {
'string': 'string'
}
}
Response Structure
(dict) --
Properties (dict) --
A map of account property key-value pairs. Keys are in the format Namespace/PropertyName.
(string) --
(string) -- String representation of the property value. The service will validate and coerce the value based on the property key's expected type. For example, integer properties expect numeric strings, and boolean properties expect "true" or "false".
Creates an IAM role from the specified role template. The new role takes its configuration—including its name, path, trust policy, inline and managed policies, permissions boundary, tags, and maximum session duration—from the role template version that you specify. For more information about roles, see IAM roles in the IAM User Guide.
If the template version defines parameters, use the ReplacementValues parameter to supply the values that the service substitutes into the role during creation.
See also: AWS API Documentation
Request Syntax
client.acquire_role(
TemplateArn='string',
TemplateMinorVersion=123,
ReplacementValues={
'string': {
'Values': [
'string',
]
}
}
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the role template to create the role from.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
integer
The minor version of the role template to use. If you do not specify a minor version, the service uses the template's default minor version.
dict
A map of values to substitute for the parameters that are defined in the role template version. Each key is a parameter name from the template, and each value is a structure that contains the replacement values for that parameter.
(string) --
(dict) --
Contains the list of replacement values for a single template parameter used when creating a role from a role template.
Values (list) -- [REQUIRED]
The list of replacement values for the template parameter.
(string) --
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
}
}
Response Structure
(dict) --
Role (dict) --
A structure that contains details about the IAM role that was created.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Retrieves information about a version of the specified role template. Role templates define a reusable configuration—including role name and path patterns, trust policy, inline and managed policies, permissions boundary, tags, and maximum session duration—that you use to create IAM roles with AcquireRole.
If you do not specify a minor version, the service returns the template's default minor version.
See also: AWS API Documentation
Request Syntax
client.get_role_template_version(
TemplateArn='string',
MinorVersion=123
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the role template whose version you want to retrieve.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
integer
The minor version of the role template to retrieve. If you do not specify a minor version, the service returns the template's default minor version.
dict
Response Syntax
{
'RoleTemplateVersion': {
'TemplateArn': 'string',
'TemplateName': 'string',
'TemplateVersionId': 'string',
'Description': 'string',
'MajorVersion': 123,
'DefaultMinorVersion': 123,
'ManagedByType': 'Service',
'ManagedByValue': 'string',
'Enabled': True|False,
'MinorVersion': 123,
'RoleNamePattern': 'string',
'RolePathPattern': 'string',
'RoleDescriptionPattern': 'string',
'AssumeRolePolicyDocumentTemplate': 'string',
'InlinePolicyTemplates': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'ManagedPolicyArns': [
'string',
],
'PermissionBoundaryArn': 'string',
'ParametersDefinition': [
{
'Name': 'string',
'Type': 'String'|'StringList'|'Number'|'NumberList'|'Arn'|'ArnList',
'SubType': 'string',
'Description': 'string',
'IsRequired': True|False,
'DefaultValue': 'string',
'Immutable': True|False
},
],
'RoleTagsTemplate': [
{
'Key': 'string',
'Value': 'string'
},
],
'MaxSessionDuration': 123,
'VersionEnabled': True|False,
'CreateTimestamp': datetime(2015, 1, 1),
'UpdateTimestamp': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
RoleTemplateVersion (dict) --
A structure that contains details about the requested role template version.
TemplateArn (string) --
The Amazon Resource Name (ARN) that identifies the role template.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
TemplateName (string) --
The friendly name that identifies the role template.
TemplateVersionId (string) --
The identifier of the role template version.
Description (string) --
The description of the role template.
MajorVersion (integer) --
The major version number of the role template.
DefaultMinorVersion (integer) --
The minor version that the service uses by default when you create a role from this template without specifying a minor version.
ManagedByType (string) --
Indicates that the role template is managed by an Amazon Web Services service.
ManagedByValue (string) --
The identifier of the Amazon Web Services service that manages the role template.
Enabled (boolean) --
Specifies whether the role template is enabled. When a template is disabled, you cannot create roles from it.
MinorVersion (integer) --
The minor version number of this role template version.
RoleNamePattern (string) --
The pattern that is used to generate the name of a role that is created from this template. The pattern can include @{parameter} placeholders that are replaced with the values you supply in the ReplacementValues parameter of AcquireRole.
RolePathPattern (string) --
The pattern that is used to generate the path of a role that is created from this template.
RoleDescriptionPattern (string) --
The pattern that is used to generate the description of a role that is created from this template.
AssumeRolePolicyDocumentTemplate (string) --
The trust policy template that grants an entity permission to assume roles that you create from this template.
InlinePolicyTemplates (list) --
A list of inline policy templates that the service embeds in roles that you create from this template.
(dict) --
Contains an inline policy template that the service embeds in roles that you create from a role template.
PolicyName (string) --
The name of the inline policy.
PolicyDocument (string) --
The inline policy document.
ManagedPolicyArns (list) --
A list of the ARNs of the managed policies that the service attaches to roles that you create from this template.
(string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
PermissionBoundaryArn (string) --
The ARN of the policy that sets the permissions boundary for roles that you create from this template.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
ParametersDefinition (list) --
A list of the parameters that are defined for this role template version. You supply values for these parameters when you create a role with AcquireRole.
(dict) --
Defines a parameter that a role template accepts. You supply values for these parameters when you create a role with AcquireRole.
Name (string) --
The name of the parameter.
Type (string) --
The data type of the parameter. Valid values are String, StringList, Number, NumberList, Arn, and ArnList.
SubType (string) --
An optional subtype that further constrains the values that are allowed for the parameter.
Description (string) --
A description of the parameter.
IsRequired (boolean) --
Specifies whether you must supply a value for the parameter when you create a role from the template.
DefaultValue (string) --
The value that the service uses for the parameter when you do not supply one.
Immutable (boolean) --
Specifies whether you can change the parameter value after you create the role.
RoleTagsTemplate (list) --
A list of tag templates that are applied to roles that are created from this template.
(dict) --
Represents a tag that is applied to roles that are created from a role template. The key and value can include @{parameter} placeholders that are replaced with template parameter values when the role is created.
Key (string) --
The key name of the tag.
Value (string) --
The value associated with the tag key.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for roles that are created from this template.
VersionEnabled (boolean) --
Specifies whether this specific minor version of the role template is enabled.
CreateTimestamp (datetime) --
The date and time, in ISO 8601 date-time format, when the role template version was created.
UpdateTimestamp (datetime) --
The date and time, in ISO 8601 date-time format, when the role template version was last updated.
{'InstanceProfile': {'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}}
Creates a new instance profile. For information about instance profiles, see Using roles for applications on Amazon EC2 in the IAM User Guide, and Instance profiles in the Amazon EC2 User Guide.
For information about the number of instance profiles you can create, see IAM object quotas in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.create_instance_profile(
InstanceProfileName='string',
Path='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The name of the instance profile to create.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
list
A list of tags that you want to attach to the newly created IAM instance profile. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful CreateInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the new instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Tags (list) --
A list of tags that are attached to the instance profile. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
{'Role': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}
Creates a new role for your Amazon Web Services account.
For more information about roles, see IAM roles in the IAM User Guide. For information about quotas for role names and the number of roles you can create, see IAM and STS quotas in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.create_role(
Path='string',
RoleName='string',
AssumeRolePolicyDocument='string',
Description='string',
MaxSessionDuration=123,
PermissionsBoundary='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
[REQUIRED]
The name of the role to create.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
[REQUIRED]
The trust relationship policy document that grants an entity permission to assume the role.
In IAM, you must provide a JSON policy that has been converted to a string. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
Any printable ASCII character ranging from the space character ( \u0020) through the end of the ASCII character range
The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF)
The special characters tab ( \u0009), line feed ( \u000A), and carriage return ( \u000D)
Upon success, the response includes the same trust policy in JSON format.
string
A description of the role.
integer
The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.
Anyone who assumes the role from the CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM roles in the IAM User Guide.
string
The ARN of the managed policy that is used to set the permissions boundary for the role.
A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.
For more information about policy types, see Policy types in the IAM User Guide.
list
A list of tags that you want to attach to the new role. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) -- [REQUIRED]
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) -- [REQUIRED]
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
}
}
Response Structure
(dict) --
Contains the response to a successful CreateRole request.
Role (dict) --
A structure containing details about the new role.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
{'Role': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}
Creates an IAM role that is linked to a specific Amazon Web Services service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your Amazon Web Services resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see Using service-linked roles in the IAM User Guide.
To attach a policy to this service-linked role, you must make the request using the Amazon Web Services service that depends on this role.
See also: AWS API Documentation
Request Syntax
client.create_service_linked_role(
AWSServiceName='string',
Description='string',
CustomSuffix='string'
)
string
[REQUIRED]
The service principal for the Amazon Web Services service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com.
Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see Amazon Web Services services that work with IAM in the IAM User Guide. Look for the services that have Yes **in the **Service-Linked Role column. Choose the Yes link to view the service-linked role documentation for that service.
string
The description of the role.
string
A string that you provide, which is combined with the service-provided prefix to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.
Some services do not support the CustomSuffix parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
}
}
Response Structure
(dict) --
Role (dict) --
A Role object that contains details about the newly created role.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
{'RoleDetailList': {'InstanceProfileList': {'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}}}
Retrieves information about all IAM users, groups, roles, and policies in your Amazon Web Services account, including their relationships to one another. Use this operation to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account.
You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.get_account_authorization_details(
Filter=[
'User'|'Role'|'Group'|'LocalManagedPolicy'|'AWSManagedPolicy',
],
MaxItems=123,
Marker='string'
)
list
A list of entity types used to filter the results. Only the entities that match the types you specify are included in the output. Use the value LocalManagedPolicy to include customer managed policies.
The format for this parameter is a comma-separated (if more than one) list of strings. Each string value in the list must be one of the valid values listed below.
(string) --
integer
Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
dict
Response Syntax
{
'UserDetailList': [
{
'Path': 'string',
'UserName': 'string',
'UserId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'UserPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'GroupList': [
'string',
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
],
'GroupDetailList': [
{
'Path': 'string',
'GroupName': 'string',
'GroupId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'GroupPolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
]
},
],
'RoleDetailList': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'InstanceProfileList': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
],
'RolePolicyList': [
{
'PolicyName': 'string',
'PolicyDocument': 'string'
},
],
'AttachedManagedPolicies': [
{
'PolicyName': 'string',
'PolicyArn': 'string'
},
],
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
}
},
],
'Policies': [
{
'PolicyName': 'string',
'PolicyId': 'string',
'Arn': 'string',
'Path': 'string',
'DefaultVersionId': 'string',
'AttachmentCount': 123,
'PermissionsBoundaryUsageCount': 123,
'IsAttachable': True|False,
'Description': 'string',
'CreateDate': datetime(2015, 1, 1),
'UpdateDate': datetime(2015, 1, 1),
'PolicyVersionList': [
{
'Document': 'string',
'VersionId': 'string',
'IsDefaultVersion': True|False,
'CreateDate': datetime(2015, 1, 1)
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful GetAccountAuthorizationDetails request.
UserDetailList (list) --
A list containing information about IAM users.
(dict) --
Contains information about an IAM user, including all the user's policies and all the IAM groups the user is in.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the user. For more information about paths, see IAM identifiers in the IAM User Guide.
UserName (string) --
The friendly name identifying the user.
UserId (string) --
The stable and unique string identifying the user. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the user was created.
UserPolicyList (list) --
A list of the inline policies embedded in the user.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
GroupList (list) --
A list of IAM groups that the user is in.
(string) --
AttachedManagedPolicies (list) --
A list of the managed policies attached to the user.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are associated with the user. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
GroupDetailList (list) --
A list containing information about IAM groups.
(dict) --
Contains information about an IAM group, including all of the group's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.
GroupName (string) --
The friendly name that identifies the group.
GroupId (string) --
The stable and unique string identifying the group. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the group was created.
GroupPolicyList (list) --
A list of the inline policies embedded in the group.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of the managed policies attached to the group.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
RoleDetailList (list) --
A list containing information about IAM roles.
(dict) --
Contains information about an IAM role, including all of the role's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The trust policy that grants permission to assume the role.
InstanceProfileList (list) --
A list of instance profiles that contain this role.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
Path (string) --
The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Tags (list) --
A list of tags that are attached to the instance profile. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RolePolicyList (list) --
A list of inline policies embedded in the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
PolicyName (string) --
The name of the policy.
PolicyDocument (string) --
The policy document.
AttachedManagedPolicies (list) --
A list of managed policies attached to the role. These policies are the role's access (permissions) policies.
(dict) --
Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
PolicyName (string) --
The friendly name of the attached policy.
PolicyArn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM User Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
Policies (list) --
A list containing information about managed policies.
(dict) --
Contains information about a managed policy, including the policy's ARN, versions, and the number of principal entities (users, groups, and roles) that the policy is attached to.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
For more information about managed policies, see Managed policies and inline policies in the IAM User Guide.
PolicyName (string) --
The friendly name (not ARN) identifying the policy.
PolicyId (string) --
The stable and unique string identifying the policy.
For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.
For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
Path (string) --
The path to the policy.
For more information about paths, see IAM identifiers in the IAM User Guide.
DefaultVersionId (string) --
The identifier for the version of the policy that is set as the default (operative) version.
For more information about policy versions, see Versioning for managed policies in the IAM User Guide.
AttachmentCount (integer) --
The number of principal entities (users, groups, and roles) that the policy is attached to.
PermissionsBoundaryUsageCount (integer) --
The number of entities (users and roles) for which the policy is used as the permissions boundary.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
IsAttachable (boolean) --
Specifies whether the policy can be attached to an IAM user, group, or role.
Description (string) --
A friendly description of the policy.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the policy was created.
UpdateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
PolicyVersionList (list) --
A list containing information about the versions of the policy.
(dict) --
Contains information about a version of a managed policy.
This data type is used as a response element in the CreatePolicyVersion, GetPolicyVersion, ListPolicyVersions, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
Document (string) --
The policy document.
The policy document is returned in the response to the GetPolicyVersion and GetAccountAuthorizationDetails operations. It is not returned in the response to the CreatePolicyVersion or ListPolicyVersions operations.
The policy document returned in this structure is URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
VersionId (string) --
The identifier for the policy version.
Policy version identifiers always begin with v (always lowercase). When a policy is created, the first policy version is v1.
IsDefaultVersion (boolean) --
Specifies whether the policy version is set as the policy's default version.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the policy version was created.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
Marker (string) --
When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfile': {'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}}
Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, see Using instance profiles in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.get_instance_profile(
InstanceProfileName='string'
)
string
[REQUIRED]
The name of the instance profile to get information about.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'InstanceProfile': {
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
}
}
Response Structure
(dict) --
Contains the response to a successful GetInstanceProfile request.
InstanceProfile (dict) --
A structure containing details about the instance profile.
Path (string) --
The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Tags (list) --
A list of tags that are attached to the instance profile. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
{'Role': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}
Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role. For more information about roles, see IAM roles in the IAM User Guide.
See also: AWS API Documentation
Request Syntax
client.get_role(
RoleName='string'
)
string
[REQUIRED]
The name of the IAM role to get information about.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
}
}
Response Structure
(dict) --
Contains the response to a successful GetRole request.
Role (dict) --
A structure containing details about the IAM role.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
{'InstanceProfiles': {'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}}
Lists the instance profiles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about instance profiles, see Using instance profiles in the IAM User Guide.
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all instance profiles whose path starts with /application_abc/component_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all instance profiles. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfiles request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
Path (string) --
The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Tags (list) --
A list of tags that are attached to the instance profile. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
Marker (string) --
When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'InstanceProfiles': {'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}}
Lists the instance profiles that have the specified associated IAM role. If there are none, the operation returns an empty list. For more information about instance profiles, go to Using instance profiles in the IAM User Guide.
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_instance_profiles_for_role(
RoleName='string',
Marker='string',
MaxItems=123
)
string
[REQUIRED]
The name of the role to list instance profiles for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'InstanceProfiles': [
{
'Path': 'string',
'InstanceProfileName': 'string',
'InstanceProfileId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListInstanceProfilesForRole request.
InstanceProfiles (list) --
A list of instance profiles.
(dict) --
Contains information about an instance profile.
This data type is used as a response element in the following operations:
Path (string) --
The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
InstanceProfileName (string) --
The name identifying the instance profile.
InstanceProfileId (string) --
The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
CreateDate (datetime) --
The date when the instance profile was created.
Roles (list) --
The role associated with the instance profile.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
Tags (list) --
A list of tags that are attached to the instance profile. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
Marker (string) --
When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Roles': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}
Lists the IAM roles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about roles, see IAM roles in the IAM User Guide.
You can paginate the results using the MaxItems and Marker parameters.
See also: AWS API Documentation
Request Syntax
client.list_roles(
PathPrefix='string',
Marker='string',
MaxItems=123
)
string
The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all roles whose path starts with /application_abc/component_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all roles. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
string
Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
integer
Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
dict
Response Syntax
{
'Roles': [
{
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
},
],
'IsTruncated': True|False,
'Marker': 'string'
}
Response Structure
(dict) --
Contains the response to a successful ListRoles request.
Roles (list) --
A list of roles.
(dict) --
Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.
IsTruncated (boolean) --
A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
Marker (string) --
When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
{'Role': {'SourceRoleTemplate': {'TemplateArn': 'string',
'TemplateMinorVersion': 'integer'}}}
Use UpdateRole instead.
Modifies only the description of a role. This operation performs the same function as the Description parameter in the UpdateRole operation.
See also: AWS API Documentation
Request Syntax
client.update_role_description(
RoleName='string',
Description='string'
)
string
[REQUIRED]
The name of the role that you want to modify.
string
[REQUIRED]
The new description that you want to apply to the specified role.
dict
Response Syntax
{
'Role': {
'Path': 'string',
'RoleName': 'string',
'RoleId': 'string',
'Arn': 'string',
'CreateDate': datetime(2015, 1, 1),
'AssumeRolePolicyDocument': 'string',
'Description': 'string',
'MaxSessionDuration': 123,
'PermissionsBoundary': {
'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
'PermissionsBoundaryArn': 'string'
},
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'RoleLastUsed': {
'LastUsedDate': datetime(2015, 1, 1),
'Region': 'string'
},
'SourceRoleTemplate': {
'TemplateArn': 'string',
'TemplateMinorVersion': 123
}
}
}
Response Structure
(dict) --
Role (dict) --
A structure that contains details about the modified role.
Path (string) --
The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
RoleName (string) --
The friendly name that identifies the role.
RoleId (string) --
The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
Arn (string) --
The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
CreateDate (datetime) --
The date and time, in ISO 8601 date-time format, when the role was created.
AssumeRolePolicyDocument (string) --
The policy that grants an entity permission to assume the role.
Description (string) --
A description of the role that you provide.
MaxSessionDuration (integer) --
The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
PermissionsBoundary (dict) --
The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
PermissionsBoundaryType (string) --
The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
PermissionsBoundaryArn (string) --
The ARN of the policy used to set the permissions boundary for the user or role.
Tags (list) --
A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
(dict) --
A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
Key (string) --
The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
Value (string) --
The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
RoleLastUsed (dict) --
Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
LastUsedDate (datetime) --
The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
Region (string) --
The name of the Amazon Web Services Region in which the role was last used.
SourceRoleTemplate (dict) --
Contains information about the role template that this role was created from. This member is present only for roles created with AcquireRole.
TemplateArn (string) --
The Amazon Resource Name (ARN) of the role template that the role was created from.
TemplateMinorVersion (integer) --
The minor version of the role template that was used to create the role.