AWS API Changes

2018/11/15 - AWS Identity and Access Management - 6 new16 updated api methods

Changes Update iam client to latest version

UntagRole (new)

Link ¶

Removes the specified tags from the role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.untag_role(
    RoleName='string',
    TagKeys=[
        'string',
    ]
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the IAM role from which you want to remove tags.

This parameter accepts (through its regex pattern) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

type TagKeys:

list

param TagKeys:

[REQUIRED]

A list of key names as a simple array of strings. The tags with matching keys are removed from the specified role.

(string) --

returns:

None

ListUserTags (new)

Link ¶

Lists the tags that are attached to the specified user. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.list_user_tags(
    UserName='string',
    Marker='string',
    MaxItems=123
)

type UserName:

string

param UserName:

[REQUIRED]

The name of the IAM user whose tags you want to see.

type Marker:

string

param Marker:

Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response to indicate where the next call should start.

type MaxItems:

integer

param MaxItems:

(Optional) Use this only when paginating results to indicate the maximum number of items that you want in the response. If additional items exist beyond the maximum that you specify, the IsTruncated response element is true.

If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when more results are available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.

rtype:

dict

returns:

Response Syntax

{
    'Tags': [
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --
- Tags (list) --
  
  The list of tags that are currently attached to the user. Each tag consists of a key name and an associated value. If no tags are attached to the specified user, the response contains an empty list.
  - (dict) --
    
    A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - Key (string) --
      
      The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
    - Value (string) --
      
      The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
      
      Note
      
      AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can use the Marker request parameter to make a subsequent pagination request that retrieves more items. Note that IAM might return fewer than the MaxItems number of results even when more results are available. Check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

UntagUser (new)

Link ¶

Removes the specified tags from the user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.untag_user(
    UserName='string',
    TagKeys=[
        'string',
    ]
)

type UserName:

string

param UserName:

[REQUIRED]

The name of the IAM user from which you want to remove tags.

type TagKeys:

list

param TagKeys:

[REQUIRED]

A list of key names as a simple array of strings. The tags with matching keys are removed from the specified user.

(string) --

returns:

None

TagRole (new)

Link ¶

Adds one or more tags to an IAM role. The role can be a regular role or a service-linked role. If a tag with the same key name already exists, then that tag is overwritten with the new value.

A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following:

Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject. Or search for all resources with the key name Cost Center and the value 41200.
Access control - Reference tags in IAM user-based and resource-based policies. You can use tags to restrict access to only an IAM user or role that has a specified tag attached. You can also restrict access to only those resources that have a certain tag attached. For examples of policies that show how to use tags to control access, see Control Access Using IAM Tags in the IAM User Guide.
Cost allocation - Use tags to help track which individuals and teams are using which AWS resources.

For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.tag_role(
    RoleName='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ]
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the role that you want to add tags to.

type Tags:

list

param Tags:

[REQUIRED]

The list of tags that you want to attach to the role. Each tag consists of a key name and an associated value. You can specify this with a JSON string.

(dict) --

A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
- Key (string) -- [REQUIRED]
  
  The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
- Value (string) -- [REQUIRED]
  
  The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
  
  Note
  
  AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.

returns:

None

ListRoleTags (new)

Link ¶

Lists the tags that are attached to the specified role. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.list_role_tags(
    RoleName='string',
    Marker='string',
    MaxItems=123
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the IAM role for which you want to see the list of tags.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'Tags': [
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --
- Tags (list) --
  
  The list of tags currently that is attached to the role. Each tag consists of a key name and an associated value. If no tags are attached to the specified role, the response contains an empty list.
  - (dict) --
    
    A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - Key (string) --
      
      The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
    - Value (string) --
      
      The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
      
      Note
      
      AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can use the Marker request parameter to make a subsequent pagination request that retrieves more items. Note that IAM might return fewer than the MaxItems number of results even when more results are available. Check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

TagUser (new)

Link ¶

Adds one or more tags to an IAM user. If a tag with the same key name already exists, then that tag is overwritten with the new value.

A tag consists of a key name and an associated value. By assigning tags to your resources, you can do the following:

Administrative grouping and discovery - Attach tags to resources to aid in organization and search. For example, you could search for all resources with the key name Project and the value MyImportantProject. Or search for all resources with the key name Cost Center and the value 41200.
Access control - Reference tags in IAM user-based and resource-based policies. You can use tags to restrict access to only an IAM requesting user or to a role that has a specified tag attached. You can also restrict access to only those resources that have a certain tag attached. For examples of policies that show how to use tags to control access, see Control Access Using IAM Tags in the IAM User Guide.
Cost allocation - Use tags to help track which individuals and teams are using which AWS resources.

For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.tag_user(
    UserName='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ]
)

type UserName:

string

param UserName:

[REQUIRED]

The name of the user that you want to add tags to.

type Tags:

list

param Tags:

[REQUIRED]

The list of tags that you want to attach to the user. Each tag consists of a key name and an associated value.

(dict) --

A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
- Key (string) -- [REQUIRED]
  
  The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
- Value (string) -- [REQUIRED]
  
  The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
  
  Note
  
  AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.

returns:

None

CreateInstanceProfile (updated)

Link ¶
Changes (response)

{'InstanceProfile': {'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}

Creates a new instance profile. For information about instance profiles, go to About Instance Profiles.

For information about the number of instance profiles you can create, see Limitations on IAM Entities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.create_instance_profile(
    InstanceProfileName='string',
    Path='string'
)

type InstanceProfileName:

string

param InstanceProfileName:

[REQUIRED]

The name of the instance profile to create.

type Path:

string

param Path:

The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

This parameter allows (per its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.

rtype:

dict

returns:

Response Syntax

{
    'InstanceProfile': {
        'Path': 'string',
        'InstanceProfileName': 'string',
        'InstanceProfileId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'Roles': [
            {
                'Path': 'string',
                'RoleName': 'string',
                'RoleId': 'string',
                'Arn': 'string',
                'CreateDate': datetime(2015, 1, 1),
                'AssumeRolePolicyDocument': 'string',
                'Description': 'string',
                'Tags': [
                    {
                        'Key': 'string',
                        'Value': 'string'
                    },
                ],
                'MaxSessionDuration': 123,
                'PermissionsBoundary': {
                    'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                    'PermissionsBoundaryArn': 'string'
                }
            },
        ]
    }
}

Response Structure

(dict) --

Contains the response to a successful CreateInstanceProfile request.
- InstanceProfile (dict) --
  
  A structure containing details about the new instance profile.
  - Path (string) --
    
    The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - InstanceProfileName (string) --
    
    The name identifying the instance profile.
  - InstanceProfileId (string) --
    
    The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
  - CreateDate (datetime) --
    
    The date when the instance profile was created.
  - Roles (list) --
    
    The role associated with the instance profile.
    - (dict) --
      
      Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
      - Path (string) --
        
        The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
      - RoleName (string) --
        
        The friendly name that identifies the role.
      - RoleId (string) --
        
        The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
      - Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
      - CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the role was created.
      - AssumeRolePolicyDocument (string) --
        
        The policy that grants an entity permission to assume the role.
      - Description (string) --
        
        A description of the role that you provide.
      - Tags (list) --
        
        A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
      - MaxSessionDuration (integer) --
        
        The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
      - PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the role.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.

CreateRole (updated)

Link ¶
Changes (request, response)
Request

{'Tags': [{'Key': 'string', 'Value': 'string'}]}

Response

{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Creates a new role for your AWS account. For more information about roles, go to IAM Roles. For information about limitations on role names and the number of roles you can create, go to Limitations on IAM Entities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.create_role(
    Path='string',
    RoleName='string',
    AssumeRolePolicyDocument='string',
    Description='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    MaxSessionDuration=123,
    PermissionsBoundary='string'
)

type Path:

string

param Path:

The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the role to create.

Role names are not distinguished by case. For example, you cannot create roles named both "PRODROLE" and "prodrole".

type AssumeRolePolicyDocument:

string

param AssumeRolePolicyDocument:

[REQUIRED]

The trust relationship policy document that grants an entity permission to assume the role.

The regex pattern used to validate this parameter is a string of characters consisting of the following:

Any printable ASCII character ranging from the space character (u0020) through the end of the ASCII character range
The printable characters in the Basic Latin and Latin-1 Supplement character set (through u00FF)
The special characters tab (u0009), line feed (u000A), and carriage return (u000D)

type Description:

string

param Description:

A description of the role.

type Tags:

list

param Tags:

A list of tags that you want to attach to the newly created role. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

(dict) --

A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
- Key (string) -- [REQUIRED]
  
  The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
- Value (string) -- [REQUIRED]
  
  The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
  
  Note
  
  AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.

type MaxSessionDuration:

integer

param MaxSessionDuration:

The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

Anyone who assumes the role from the AWS CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM Roles in the IAM User Guide.

type PermissionsBoundary:

string

param PermissionsBoundary:

The ARN of the policy that is used to set the permissions boundary for the role.

rtype:

dict

returns:

Response Syntax

{
    'Role': {
        'Path': 'string',
        'RoleName': 'string',
        'RoleId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'AssumeRolePolicyDocument': 'string',
        'Description': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'MaxSessionDuration': 123,
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --

Contains the response to a successful CreateRole request.
- Role (dict) --
  
  A structure containing details about the new role.
  - Path (string) --
    
    The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - RoleName (string) --
    
    The friendly name that identifies the role.
  - RoleId (string) --
    
    The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the role was created.
  - AssumeRolePolicyDocument (string) --
    
    The policy that grants an entity permission to assume the role.
  - Description (string) --
    
    A description of the role that you provide.
  - Tags (list) --
    
    A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - MaxSessionDuration (integer) --
    
    The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the role.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.

CreateServiceLinkedRole (updated)

Link ¶
Changes (response)

{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Creates an IAM role that is linked to a specific AWS service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your AWS resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see Using Service-Linked Roles in the IAM User Guide.

To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.

See also: AWS API Documentation

Request Syntax

client.create_service_linked_role(
    AWSServiceName='string',
    Description='string',
    CustomSuffix='string'
)

type AWSServiceName:

string

param AWSServiceName:

[REQUIRED]

The service principal for the AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com.

Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see AWS Services That Work with IAM in the IAM User Guide and look for the services that have Yes **in the **Service-Linked Role column. Choose the Yes link to view the service-linked role documentation for that service.

type Description:

string

param Description:

The description of the role.

type CustomSuffix:

string

param CustomSuffix:

A string that you provide, which is combined with the service-provided prefix to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.

Some services do not support the CustomSuffix parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix.

rtype:

dict

returns:

Response Syntax

{
    'Role': {
        'Path': 'string',
        'RoleName': 'string',
        'RoleId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'AssumeRolePolicyDocument': 'string',
        'Description': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'MaxSessionDuration': 123,
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --
- Role (dict) --
  
  A Role object that contains details about the newly created role.
  - Path (string) --
    
    The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - RoleName (string) --
    
    The friendly name that identifies the role.
  - RoleId (string) --
    
    The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the role was created.
  - AssumeRolePolicyDocument (string) --
    
    The policy that grants an entity permission to assume the role.
  - Description (string) --
    
    A description of the role that you provide.
  - Tags (list) --
    
    A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - MaxSessionDuration (integer) --
    
    The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the role.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.

CreateUser (updated)

Link ¶
Changes (request, response)
Request

{'Tags': [{'Key': 'string', 'Value': 'string'}]}

Response

{'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Creates a new IAM user for your AWS account.

For information about limitations on the number of IAM users you can create, see Limitations on IAM Entities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.create_user(
    Path='string',
    UserName='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    PermissionsBoundary='string'
)

type Path:

string

param Path:

The path for the user name. For more information about paths, see IAM Identifiers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

type UserName:

string

param UserName:

[REQUIRED]

The name of the user to create.

This parameter allows (per its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".

type Tags:

list

param Tags:

A list of tags that you want to attach to the newly created user. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.

(dict) --

A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
- Key (string) -- [REQUIRED]
  
  The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
- Value (string) -- [REQUIRED]
  
  The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
  
  Note
  
  AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.

type PermissionsBoundary:

string

param PermissionsBoundary:

The ARN of the policy that is used to set the permissions boundary for the user.

rtype:

dict

returns:

Response Syntax

{
    'User': {
        'Path': 'string',
        'UserName': 'string',
        'UserId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'PasswordLastUsed': datetime(2015, 1, 1),
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --

Contains the response to a successful CreateUser request.
- User (dict) --
  
  A structure with details about the new IAM user.
  - Path (string) --
    
    The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - UserName (string) --
    
    The friendly name identifying the user.
  - UserId (string) --
    
    The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the user was created.
  - PasswordLastUsed (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
    - The user never had a password.
    - A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
    A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
    
    This value is returned only in the GetUser and ListUsers operations.
  - Tags (list) --
    
    A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the user.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.

CreateVirtualMFADevice (updated)

Link ¶
Changes (response)

{'VirtualMFADevice': {'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}

Creates a new virtual MFA device for the AWS account. After creating the virtual MFA, use EnableMFADevice to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, go to Using a Virtual MFA Device in the IAM User Guide.

For information about limits on the number of MFA devices you can create, see Limitations on Entities in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.create_virtual_mfa_device(
    Path='string',
    VirtualMFADeviceName='string'
)

type Path:

string

param Path:

The path for the virtual MFA device. For more information about paths, see IAM Identifiers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

type VirtualMFADeviceName:

string

param VirtualMFADeviceName:

[REQUIRED]

The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.

rtype:

dict

returns:

Response Syntax

{
    'VirtualMFADevice': {
        'SerialNumber': 'string',
        'Base32StringSeed': b'bytes',
        'QRCodePNG': b'bytes',
        'User': {
            'Path': 'string',
            'UserName': 'string',
            'UserId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'PasswordLastUsed': datetime(2015, 1, 1),
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
        'EnableDate': datetime(2015, 1, 1)
    }
}

Response Structure

(dict) --

Contains the response to a successful CreateVirtualMFADevice request.
- VirtualMFADevice (dict) --
  
  A structure containing details about the new virtual MFA device.
  - SerialNumber (string) --
    
    The serial number associated with VirtualMFADevice.
  - Base32StringSeed (bytes) --
    
    The Base32 seed defined as specified in RFC3548. The Base32StringSeed is Base64-encoded.
  - QRCodePNG (bytes) --
    
    A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
  - User (dict) --
    
    The IAM user associated with this virtual MFA device.
    - Path (string) --
      
      The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - UserName (string) --
      
      The friendly name identifying the user.
    - UserId (string) --
      
      The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user was created.
    - PasswordLastUsed (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
      - The user never had a password.
      - A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
      A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
      
      This value is returned only in the GetUser and ListUsers operations.
    - Tags (list) --
      
      A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the user.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
  - EnableDate (datetime) --
    
    The date and time on which the virtual MFA device was enabled.

GetAccountAuthorizationDetails (updated)

Link ¶
Changes (response)

{'RoleDetailList': {'InstanceProfileList': {'Roles': {'Tags': [{'Key': 'string',
                                                                'Value': 'string'}]}},
                    'Tags': [{'Key': 'string', 'Value': 'string'}]},
 'UserDetailList': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Retrieves information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another. Use this API to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account.

You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.get_account_authorization_details(
    Filter=[
        'User'|'Role'|'Group'|'LocalManagedPolicy'|'AWSManagedPolicy',
    ],
    MaxItems=123,
    Marker='string'
)

type Filter:

list

param Filter:

A list of entity types used to filter the results. Only the entities that match the types you specify are included in the output. Use the value LocalManagedPolicy to include customer managed policies.

The format for this parameter is a comma-separated (if more than one) list of strings. Each string value in the list must be one of the valid values listed below.

(string) --

type MaxItems:

integer

param MaxItems:

(Optional) Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.

If you do not include this parameter, it defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true and Marker contains a value to include in the subsequent call that tells the service where to continue from.

type Marker:

string

param Marker:

rtype:

dict

returns:

Response Syntax

{
    'UserDetailList': [
        {
            'Path': 'string',
            'UserName': 'string',
            'UserId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'UserPolicyList': [
                {
                    'PolicyName': 'string',
                    'PolicyDocument': 'string'
                },
            ],
            'GroupList': [
                'string',
            ],
            'AttachedManagedPolicies': [
                {
                    'PolicyName': 'string',
                    'PolicyArn': 'string'
                },
            ],
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
    ],
    'GroupDetailList': [
        {
            'Path': 'string',
            'GroupName': 'string',
            'GroupId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'GroupPolicyList': [
                {
                    'PolicyName': 'string',
                    'PolicyDocument': 'string'
                },
            ],
            'AttachedManagedPolicies': [
                {
                    'PolicyName': 'string',
                    'PolicyArn': 'string'
                },
            ]
        },
    ],
    'RoleDetailList': [
        {
            'Path': 'string',
            'RoleName': 'string',
            'RoleId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'AssumeRolePolicyDocument': 'string',
            'InstanceProfileList': [
                {
                    'Path': 'string',
                    'InstanceProfileName': 'string',
                    'InstanceProfileId': 'string',
                    'Arn': 'string',
                    'CreateDate': datetime(2015, 1, 1),
                    'Roles': [
                        {
                            'Path': 'string',
                            'RoleName': 'string',
                            'RoleId': 'string',
                            'Arn': 'string',
                            'CreateDate': datetime(2015, 1, 1),
                            'AssumeRolePolicyDocument': 'string',
                            'Description': 'string',
                            'Tags': [
                                {
                                    'Key': 'string',
                                    'Value': 'string'
                                },
                            ],
                            'MaxSessionDuration': 123,
                            'PermissionsBoundary': {
                                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                                'PermissionsBoundaryArn': 'string'
                            }
                        },
                    ]
                },
            ],
            'RolePolicyList': [
                {
                    'PolicyName': 'string',
                    'PolicyDocument': 'string'
                },
            ],
            'AttachedManagedPolicies': [
                {
                    'PolicyName': 'string',
                    'PolicyArn': 'string'
                },
            ],
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
    ],
    'Policies': [
        {
            'PolicyName': 'string',
            'PolicyId': 'string',
            'Arn': 'string',
            'Path': 'string',
            'DefaultVersionId': 'string',
            'AttachmentCount': 123,
            'PermissionsBoundaryUsageCount': 123,
            'IsAttachable': True|False,
            'Description': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'UpdateDate': datetime(2015, 1, 1),
            'PolicyVersionList': [
                {
                    'Document': 'string',
                    'VersionId': 'string',
                    'IsDefaultVersion': True|False,
                    'CreateDate': datetime(2015, 1, 1)
                },
            ]
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful GetAccountAuthorizationDetails request.
- UserDetailList (list) --
  
  A list containing information about IAM users.
  - (dict) --
    
    Contains information about an IAM user, including all the user's policies and all the IAM groups the user is in.
    
    This data type is used as a response element in the GetAccountAuthorizationDetails operation.
    - Path (string) --
      
      The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - UserName (string) --
      
      The friendly name identifying the user.
    - UserId (string) --
      
      The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
      
      For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user was created.
    - UserPolicyList (list) --
      
      A list of the inline policies embedded in the user.
      - (dict) --
        
        Contains information about an IAM policy, including the policy document.
        
        This data type is used as a response element in the GetAccountAuthorizationDetails operation.
        
        PolicyName (string) --
        
        The name of the policy.
        
        PolicyDocument (string) --
        
        The policy document.
    - GroupList (list) --
      
      A list of IAM groups that the user is in.
      - (string) --
    - AttachedManagedPolicies (list) --
      
      A list of the managed policies attached to the user.
      - (dict) --
        
        Contains information about an attached policy.
        
        An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
        
        For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
        
        PolicyName (string) --
        
        The friendly name of the attached policy.
        
        PolicyArn (string) --
        
        The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
        
        For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - Tags (list) --
      
      A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the user.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- GroupDetailList (list) --
  
  A list containing information about IAM groups.
  - (dict) --
    
    Contains information about an IAM group, including all of the group's policies.
    
    This data type is used as a response element in the GetAccountAuthorizationDetails operation.
    - Path (string) --
      
      The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - GroupName (string) --
      
      The friendly name that identifies the group.
    - GroupId (string) --
      
      The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
      
      For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the group was created.
    - GroupPolicyList (list) --
      
      A list of the inline policies embedded in the group.
      - (dict) --
        
        Contains information about an IAM policy, including the policy document.
        
        This data type is used as a response element in the GetAccountAuthorizationDetails operation.
        
        PolicyName (string) --
        
        The name of the policy.
        
        PolicyDocument (string) --
        
        The policy document.
    - AttachedManagedPolicies (list) --
      
      A list of the managed policies attached to the group.
      - (dict) --
        
        Contains information about an attached policy.
        
        An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
        
        For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
        
        PolicyName (string) --
        
        The friendly name of the attached policy.
        
        PolicyArn (string) --
        
        The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
        
        For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
- RoleDetailList (list) --
  
  A list containing information about IAM roles.
  - (dict) --
    
    Contains information about an IAM role, including all of the role's policies.
    
    This data type is used as a response element in the GetAccountAuthorizationDetails operation.
    - Path (string) --
      
      The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - RoleName (string) --
      
      The friendly name that identifies the role.
    - RoleId (string) --
      
      The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
      
      For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the role was created.
    - AssumeRolePolicyDocument (string) --
      
      The trust policy that grants permission to assume the role.
    - InstanceProfileList (list) --
      
      A list of instance profiles that contain this role.
      - (dict) --
        
        Contains information about an instance profile.
        
        This data type is used as a response element in the following operations:
        
        CreateInstanceProfile
        
        GetInstanceProfile
        
        ListInstanceProfiles
        
        ListInstanceProfilesForRole
        
        Path (string) --
        
        The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
        
        InstanceProfileName (string) --
        
        The name identifying the instance profile.
        
        InstanceProfileId (string) --
        
        The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
        
        Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
        
        CreateDate (datetime) --
        
        The date when the instance profile was created.
        
        Roles (list) --
        
        The role associated with the instance profile.
        
        (dict) --
        
        Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
        
        Path (string) --
        
        The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
        
        RoleName (string) --
        
        The friendly name that identifies the role.
        
        RoleId (string) --
        
        The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
        
        Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
        
        CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the role was created.
        
        AssumeRolePolicyDocument (string) --
        
        The policy that grants an entity permission to assume the role.
        
        Description (string) --
        
        A description of the role that you provide.
        
        Tags (list) --
        
        A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
        
        MaxSessionDuration (integer) --
        
        The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
        
        PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the role.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
    - RolePolicyList (list) --
      
      A list of inline policies embedded in the role. These policies are the role's access (permissions) policies.
      - (dict) --
        
        Contains information about an IAM policy, including the policy document.
        
        This data type is used as a response element in the GetAccountAuthorizationDetails operation.
        
        PolicyName (string) --
        
        The name of the policy.
        
        PolicyDocument (string) --
        
        The policy document.
    - AttachedManagedPolicies (list) --
      
      A list of managed policies attached to the role. These policies are the role's access (permissions) policies.
      - (dict) --
        
        Contains information about an attached policy.
        
        An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
        
        For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
        
        PolicyName (string) --
        
        The friendly name of the attached policy.
        
        PolicyArn (string) --
        
        The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
        
        For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - Tags (list) --
      
      A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the role.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- Policies (list) --
  
  A list containing information about managed policies.
  - (dict) --
    
    Contains information about a managed policy, including the policy's ARN, versions, and the number of principal entities (users, groups, and roles) that the policy is attached to.
    
    This data type is used as a response element in the GetAccountAuthorizationDetails operation.
    
    For more information about managed policies, see Managed Policies and Inline Policies in the Using IAM guide.
    - PolicyName (string) --
      
      The friendly name (not ARN) identifying the policy.
    - PolicyId (string) --
      
      The stable and unique string identifying the policy.
      
      For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
      
      For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.
    - Path (string) --
      
      The path to the policy.
      
      For more information about paths, see IAM Identifiers in the Using IAM guide.
    - DefaultVersionId (string) --
      
      The identifier for the version of the policy that is set as the default (operative) version.
      
      For more information about policy versions, see Versioning for Managed Policies in the Using IAM guide.
    - AttachmentCount (integer) --
      
      The number of principal entities (users, groups, and roles) that the policy is attached to.
    - PermissionsBoundaryUsageCount (integer) --
      
      The number of entities (users and roles) for which the policy is used as the permissions boundary.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - IsAttachable (boolean) --
      
      Specifies whether the policy can be attached to an IAM user, group, or role.
    - Description (string) --
      
      A friendly description of the policy.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the policy was created.
    - UpdateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the policy was last updated.
      
      When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
    - PolicyVersionList (list) --
      
      A list containing information about the versions of the policy.
      - (dict) --
        
        Contains information about a version of a managed policy.
        
        This data type is used as a response element in the CreatePolicyVersion, GetPolicyVersion, ListPolicyVersions, and GetAccountAuthorizationDetails operations.
        
        For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.
        
        Document (string) --
        
        The policy document.
        
        The policy document is returned in the response to the GetPolicyVersion and GetAccountAuthorizationDetails operations. It is not returned in the response to the CreatePolicyVersion or ListPolicyVersions operations.
        
        The policy document returned in this structure is URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
        
        VersionId (string) --
        
        The identifier for the policy version.
        
        Policy version identifiers always begin with v (always lowercase). When a policy is created, the first policy version is v1.
        
        IsDefaultVersion (boolean) --
        
        Specifies whether the policy version is set as the policy's default version.
        
        CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the policy version was created.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

GetGroup (updated)

Link ¶
Changes (response)

{'Users': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Returns a list of IAM users that are in the specified IAM group. You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.get_group(
    GroupName='string',
    Marker='string',
    MaxItems=123
)

type GroupName:

string

param GroupName:

[REQUIRED]

The name of the group.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'Group': {
        'Path': 'string',
        'GroupName': 'string',
        'GroupId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1)
    },
    'Users': [
        {
            'Path': 'string',
            'UserName': 'string',
            'UserId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'PasswordLastUsed': datetime(2015, 1, 1),
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful GetGroup request.
- Group (dict) --
  
  A structure that contains details about the group.
  - Path (string) --
    
    The path to the group. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - GroupName (string) --
    
    The friendly name that identifies the group.
  - GroupId (string) --
    
    The stable and unique string identifying the group. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the group. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the group was created.
- Users (list) --
  
  A list of users in the group.
  - (dict) --
    
    Contains information about an IAM user entity.
    
    This data type is used as a response element in the following operations:
    - CreateUser
    - GetUser
    - ListUsers
    - Path (string) --
      
      The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - UserName (string) --
      
      The friendly name identifying the user.
    - UserId (string) --
      
      The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user was created.
    - PasswordLastUsed (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
      - The user never had a password.
      - A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
      A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
      
      This value is returned only in the GetUser and ListUsers operations.
    - Tags (list) --
      
      A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the user.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

GetInstanceProfile (updated)

Link ¶
Changes (response)

{'InstanceProfile': {'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}}

Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, see About Instance Profiles in the IAM User Guide.

See also: AWS API Documentation

Request Syntax

client.get_instance_profile(
    InstanceProfileName='string'
)

type InstanceProfileName:

string

param InstanceProfileName:

[REQUIRED]

The name of the instance profile to get information about.

rtype:

dict

returns:

Response Syntax

{
    'InstanceProfile': {
        'Path': 'string',
        'InstanceProfileName': 'string',
        'InstanceProfileId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'Roles': [
            {
                'Path': 'string',
                'RoleName': 'string',
                'RoleId': 'string',
                'Arn': 'string',
                'CreateDate': datetime(2015, 1, 1),
                'AssumeRolePolicyDocument': 'string',
                'Description': 'string',
                'Tags': [
                    {
                        'Key': 'string',
                        'Value': 'string'
                    },
                ],
                'MaxSessionDuration': 123,
                'PermissionsBoundary': {
                    'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                    'PermissionsBoundaryArn': 'string'
                }
            },
        ]
    }
}

Response Structure

(dict) --

Contains the response to a successful GetInstanceProfile request.
- InstanceProfile (dict) --
  
  A structure containing details about the instance profile.
  - Path (string) --
    
    The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - InstanceProfileName (string) --
    
    The name identifying the instance profile.
  - InstanceProfileId (string) --
    
    The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
  - CreateDate (datetime) --
    
    The date when the instance profile was created.
  - Roles (list) --
    
    The role associated with the instance profile.
    - (dict) --
      
      Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
      - Path (string) --
        
        The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
      - RoleName (string) --
        
        The friendly name that identifies the role.
      - RoleId (string) --
        
        The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
      - Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
      - CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the role was created.
      - AssumeRolePolicyDocument (string) --
        
        The policy that grants an entity permission to assume the role.
      - Description (string) --
        
        A description of the role that you provide.
      - Tags (list) --
        
        A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
      - MaxSessionDuration (integer) --
        
        The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
      - PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the role.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.

GetRole (updated)

Link ¶
Changes (response)

{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role. For more information about roles, see Working with Roles.

See also: AWS API Documentation

Request Syntax

client.get_role(
    RoleName='string'
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the IAM role to get information about.

rtype:

dict

returns:

Response Syntax

{
    'Role': {
        'Path': 'string',
        'RoleName': 'string',
        'RoleId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'AssumeRolePolicyDocument': 'string',
        'Description': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'MaxSessionDuration': 123,
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --

Contains the response to a successful GetRole request.
- Role (dict) --
  
  A structure containing details about the IAM role.
  - Path (string) --
    
    The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - RoleName (string) --
    
    The friendly name that identifies the role.
  - RoleId (string) --
    
    The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the role was created.
  - AssumeRolePolicyDocument (string) --
    
    The policy that grants an entity permission to assume the role.
  - Description (string) --
    
    A description of the role that you provide.
  - Tags (list) --
    
    A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - MaxSessionDuration (integer) --
    
    The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the role.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.

GetUser (updated)

Link ¶
Changes (response)

{'User': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID used to sign the request to this API.

See also: AWS API Documentation

Request Syntax

client.get_user(
    UserName='string'
)

type UserName:

string

param UserName:

The name of the user to get information about.

This parameter is optional. If it is not included, it defaults to the user making the request. This parameter allows (per its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

rtype:

dict

returns:

Response Syntax

{
    'User': {
        'Path': 'string',
        'UserName': 'string',
        'UserId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'PasswordLastUsed': datetime(2015, 1, 1),
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --

Contains the response to a successful GetUser request.
- User (dict) --
  
  A structure containing details about the IAM user.
  
  Warning
  
  Due to a service issue, password last used data does not include password use from May 3rd 2018 22:50 PDT to May 23rd 2018 14:08 PDT. This affects last sign-in dates shown in the IAM console and password last used dates in the IAM credential report, and returned by this GetUser API. If users signed in during the affected time, the password last used date that is returned is the date the user last signed in before May 3rd 2018. For users that signed in after May 23rd 2018 14:08 PDT, the returned password last used date is accurate.
  
  If you use password last used information to identify unused credentials for deletion, such as deleting users who did not sign in to AWS in the last 90 days, we recommend that you adjust your evaluation window to include dates after May 23rd 2018. Alternatively, if your users use access keys to access AWS programmatically you can refer to access key last used information because it is accurate for all dates.
  - Path (string) --
    
    The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - UserName (string) --
    
    The friendly name identifying the user.
  - UserId (string) --
    
    The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the user was created.
  - PasswordLastUsed (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
    - The user never had a password.
    - A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
    A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
    
    This value is returned only in the GetUser and ListUsers operations.
  - Tags (list) --
    
    A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the user.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.

ListInstanceProfiles (updated)

Link ¶
Changes (response)

{'InstanceProfiles': {'Roles': {'Tags': [{'Key': 'string',
                                          'Value': 'string'}]}}}

Lists the instance profiles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles.

You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.list_instance_profiles(
    PathPrefix='string',
    Marker='string',
    MaxItems=123
)

type PathPrefix:

string

param PathPrefix:

The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all instance profiles whose path starts with /application_abc/component_xyz/.

This parameter is optional. If it is not included, it defaults to a slash (/), listing all instance profiles. This parameter allows (per its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'InstanceProfiles': [
        {
            'Path': 'string',
            'InstanceProfileName': 'string',
            'InstanceProfileId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'Roles': [
                {
                    'Path': 'string',
                    'RoleName': 'string',
                    'RoleId': 'string',
                    'Arn': 'string',
                    'CreateDate': datetime(2015, 1, 1),
                    'AssumeRolePolicyDocument': 'string',
                    'Description': 'string',
                    'Tags': [
                        {
                            'Key': 'string',
                            'Value': 'string'
                        },
                    ],
                    'MaxSessionDuration': 123,
                    'PermissionsBoundary': {
                        'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                        'PermissionsBoundaryArn': 'string'
                    }
                },
            ]
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful ListInstanceProfiles request.
- InstanceProfiles (list) --
  
  A list of instance profiles.
  - (dict) --
    
    Contains information about an instance profile.
    
    This data type is used as a response element in the following operations:
    - CreateInstanceProfile
    - GetInstanceProfile
    - ListInstanceProfiles
    - ListInstanceProfilesForRole
    - Path (string) --
      
      The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - InstanceProfileName (string) --
      
      The name identifying the instance profile.
    - InstanceProfileId (string) --
      
      The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
    - CreateDate (datetime) --
      
      The date when the instance profile was created.
    - Roles (list) --
      
      The role associated with the instance profile.
      - (dict) --
        
        Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
        
        Path (string) --
        
        The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
        
        RoleName (string) --
        
        The friendly name that identifies the role.
        
        RoleId (string) --
        
        The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
        
        Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
        
        CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the role was created.
        
        AssumeRolePolicyDocument (string) --
        
        The policy that grants an entity permission to assume the role.
        
        Description (string) --
        
        A description of the role that you provide.
        
        Tags (list) --
        
        A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
        
        MaxSessionDuration (integer) --
        
        The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
        
        PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the role.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

ListInstanceProfilesForRole (updated)

Link ¶
Changes (response)

{'InstanceProfiles': {'Roles': {'Tags': [{'Key': 'string',
                                          'Value': 'string'}]}}}

Lists the instance profiles that have the specified associated IAM role. If there are none, the operation returns an empty list. For more information about instance profiles, go to About Instance Profiles.

You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.list_instance_profiles_for_role(
    RoleName='string',
    Marker='string',
    MaxItems=123
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the role to list instance profiles for.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'InstanceProfiles': [
        {
            'Path': 'string',
            'InstanceProfileName': 'string',
            'InstanceProfileId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'Roles': [
                {
                    'Path': 'string',
                    'RoleName': 'string',
                    'RoleId': 'string',
                    'Arn': 'string',
                    'CreateDate': datetime(2015, 1, 1),
                    'AssumeRolePolicyDocument': 'string',
                    'Description': 'string',
                    'Tags': [
                        {
                            'Key': 'string',
                            'Value': 'string'
                        },
                    ],
                    'MaxSessionDuration': 123,
                    'PermissionsBoundary': {
                        'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                        'PermissionsBoundaryArn': 'string'
                    }
                },
            ]
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful ListInstanceProfilesForRole request.
- InstanceProfiles (list) --
  
  A list of instance profiles.
  - (dict) --
    
    Contains information about an instance profile.
    
    This data type is used as a response element in the following operations:
    - CreateInstanceProfile
    - GetInstanceProfile
    - ListInstanceProfiles
    - ListInstanceProfilesForRole
    - Path (string) --
      
      The path to the instance profile. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - InstanceProfileName (string) --
      
      The name identifying the instance profile.
    - InstanceProfileId (string) --
      
      The stable and unique string identifying the instance profile. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM Identifiers in the Using IAM guide.
    - CreateDate (datetime) --
      
      The date when the instance profile was created.
    - Roles (list) --
      
      The role associated with the instance profile.
      - (dict) --
        
        Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
        
        Path (string) --
        
        The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
        
        RoleName (string) --
        
        The friendly name that identifies the role.
        
        RoleId (string) --
        
        The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
        
        Arn (string) --
        
        The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
        
        CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the role was created.
        
        AssumeRolePolicyDocument (string) --
        
        The policy that grants an entity permission to assume the role.
        
        Description (string) --
        
        A description of the role that you provide.
        
        Tags (list) --
        
        A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
        
        MaxSessionDuration (integer) --
        
        The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
        
        PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the role.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

ListRoles (updated)

Link ¶
Changes (response)

{'Roles': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Lists the IAM roles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about roles, go to Working with Roles.

You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.list_roles(
    PathPrefix='string',
    Marker='string',
    MaxItems=123
)

type PathPrefix:

string

param PathPrefix:

The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all roles whose path starts with /application_abc/component_xyz/.

This parameter is optional. If it is not included, it defaults to a slash (/), listing all roles. This parameter allows (per its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'Roles': [
        {
            'Path': 'string',
            'RoleName': 'string',
            'RoleId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'AssumeRolePolicyDocument': 'string',
            'Description': 'string',
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'MaxSessionDuration': 123,
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful ListRoles request.
- Roles (list) --
  
  A list of roles.
  - (dict) --
    
    Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
    - Path (string) --
      
      The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - RoleName (string) --
      
      The friendly name that identifies the role.
    - RoleId (string) --
      
      The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the role was created.
    - AssumeRolePolicyDocument (string) --
      
      The policy that grants an entity permission to assume the role.
    - Description (string) --
      
      A description of the role that you provide.
    - Tags (list) --
      
      A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - MaxSessionDuration (integer) --
      
      The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the role.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

ListUsers (updated)

Link ¶
Changes (response)

{'Users': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Lists the IAM users that have the specified path prefix. If no path prefix is specified, the operation returns all users in the AWS account. If there are none, the operation returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.list_users(
    PathPrefix='string',
    Marker='string',
    MaxItems=123
)

type PathPrefix:

string

param PathPrefix:

The path prefix for filtering the results. For example: /division_abc/subdivision_xyz/, which would get all user names whose path starts with /division_abc/subdivision_xyz/.

This parameter is optional. If it is not included, it defaults to a slash (/), listing all user names. This parameter allows (per its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (u0021) through the DEL character (u007F), including most punctuation characters, digits, and upper and lowercased letters.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'Users': [
        {
            'Path': 'string',
            'UserName': 'string',
            'UserId': 'string',
            'Arn': 'string',
            'CreateDate': datetime(2015, 1, 1),
            'PasswordLastUsed': datetime(2015, 1, 1),
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ],
            'PermissionsBoundary': {
                'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                'PermissionsBoundaryArn': 'string'
            }
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful ListUsers request.
- Users (list) --
  
  A list of users.
  - (dict) --
    
    Contains information about an IAM user entity.
    
    This data type is used as a response element in the following operations:
    - CreateUser
    - GetUser
    - ListUsers
    - Path (string) --
      
      The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
    - UserName (string) --
      
      The friendly name identifying the user.
    - UserId (string) --
      
      The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
    - Arn (string) --
      
      The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
    - CreateDate (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user was created.
    - PasswordLastUsed (datetime) --
      
      The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
      - The user never had a password.
      - A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
      A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
      
      This value is returned only in the GetUser and ListUsers operations.
    - Tags (list) --
      
      A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
    - PermissionsBoundary (dict) --
      
      The ARN of the policy used to set the permissions boundary for the user.
      
      For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
      - PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
      - PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

ListVirtualMFADevices (updated)

Link ¶
Changes (response)

{'VirtualMFADevices': {'User': {'Tags': [{'Key': 'string',
                                          'Value': 'string'}]}}}

Lists the virtual MFA devices defined in the AWS account by assignment status. If you do not specify an assignment status, the operation returns a list of all virtual MFA devices. Assignment status can be Assigned, Unassigned, or Any.

You can paginate the results using the MaxItems and Marker parameters.

See also: AWS API Documentation

Request Syntax

client.list_virtual_mfa_devices(
    AssignmentStatus='Assigned'|'Unassigned'|'Any',
    Marker='string',
    MaxItems=123
)

type AssignmentStatus:

string

param AssignmentStatus:

The status ( Unassigned or Assigned) of the devices to list. If you do not specify an AssignmentStatus, the operation defaults to Any which lists both assigned and unassigned virtual MFA devices.

type Marker:

string

param Marker:

type MaxItems:

integer

param MaxItems:

rtype:

dict

returns:

Response Syntax

{
    'VirtualMFADevices': [
        {
            'SerialNumber': 'string',
            'Base32StringSeed': b'bytes',
            'QRCodePNG': b'bytes',
            'User': {
                'Path': 'string',
                'UserName': 'string',
                'UserId': 'string',
                'Arn': 'string',
                'CreateDate': datetime(2015, 1, 1),
                'PasswordLastUsed': datetime(2015, 1, 1),
                'Tags': [
                    {
                        'Key': 'string',
                        'Value': 'string'
                    },
                ],
                'PermissionsBoundary': {
                    'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
                    'PermissionsBoundaryArn': 'string'
                }
            },
            'EnableDate': datetime(2015, 1, 1)
        },
    ],
    'IsTruncated': True|False,
    'Marker': 'string'
}

Response Structure

(dict) --

Contains the response to a successful ListVirtualMFADevices request.
- VirtualMFADevices (list) --
  
  The list of virtual MFA devices in the current account that match the AssignmentStatus value that was passed in the request.
  - (dict) --
    
    Contains information about a virtual MFA device.
    - SerialNumber (string) --
      
      The serial number associated with VirtualMFADevice.
    - Base32StringSeed (bytes) --
      
      The Base32 seed defined as specified in RFC3548. The Base32StringSeed is Base64-encoded.
    - QRCodePNG (bytes) --
      
      A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments, AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in Base32 format. The Base32String value is Base64-encoded.
    - User (dict) --
      
      The IAM user associated with this virtual MFA device.
      - Path (string) --
        
        The path to the user. For more information about paths, see IAM Identifiers in the Using IAM guide.
      - UserName (string) --
        
        The friendly name identifying the user.
      - UserId (string) --
        
        The stable and unique string identifying the user. For more information about IDs, see IAM Identifiers in the Using IAM guide.
      - Arn (string) --
        
        The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the Using IAM guide.
      - CreateDate (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the user was created.
      - PasswordLastUsed (datetime) --
        
        The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an AWS website. For a list of AWS websites that capture a user's last sign-in time, see the Credential Reports topic in the Using IAM guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value) then it indicates that they never signed in with a password. This can be because:
        
        The user never had a password.
        
        A password exists but has not been used since IAM started tracking this information on October 20th, 2014.
        
        A null does not mean that the user never had a password. Also, if the user does not currently have a password, but had one in the past, then this field contains the date and time the most recent password was used.
        
        This value is returned only in the GetUser and ListUsers operations.
      - Tags (list) --
        
        A list of tags that are associated with the specified user. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        (dict) --
        
        A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
        
        Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
        
        Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
      - PermissionsBoundary (dict) --
        
        The ARN of the policy used to set the permissions boundary for the user.
        
        For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
        
        PermissionsBoundaryType (string) --
        
        The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
        
        PermissionsBoundaryArn (string) --
        
        The ARN of the policy used to set the permissions boundary for the user or role.
    - EnableDate (datetime) --
      
      The date and time on which the virtual MFA device was enabled.
- IsTruncated (boolean) --
  
  A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all of your results.
- Marker (string) --
  
  When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

UpdateRoleDescription (updated)

Link ¶
Changes (response)

{'Role': {'Tags': [{'Key': 'string', 'Value': 'string'}]}}

Use instead.

Modifies only the description of a role. This operation performs the same function as the Description parameter in the UpdateRole operation.

See also: AWS API Documentation

Request Syntax

client.update_role_description(
    RoleName='string',
    Description='string'
)

type RoleName:

string

param RoleName:

[REQUIRED]

The name of the role that you want to modify.

type Description:

string

param Description:

[REQUIRED]

The new description that you want to apply to the specified role.

rtype:

dict

returns:

Response Syntax

{
    'Role': {
        'Path': 'string',
        'RoleName': 'string',
        'RoleId': 'string',
        'Arn': 'string',
        'CreateDate': datetime(2015, 1, 1),
        'AssumeRolePolicyDocument': 'string',
        'Description': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'MaxSessionDuration': 123,
        'PermissionsBoundary': {
            'PermissionsBoundaryType': 'PermissionsBoundaryPolicy',
            'PermissionsBoundaryArn': 'string'
        }
    }
}

Response Structure

(dict) --
- Role (dict) --
  
  A structure that contains details about the modified role.
  - Path (string) --
    
    The path to the role. For more information about paths, see IAM Identifiers in the Using IAM guide.
  - RoleName (string) --
    
    The friendly name that identifies the role.
  - RoleId (string) --
    
    The stable and unique string identifying the role. For more information about IDs, see IAM Identifiers in the Using IAM guide.
  - Arn (string) --
    
    The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM Identifiers in the IAM User Guide guide.
  - CreateDate (datetime) --
    
    The date and time, in ISO 8601 date-time format, when the role was created.
  - AssumeRolePolicyDocument (string) --
    
    The policy that grants an entity permission to assume the role.
  - Description (string) --
    
    A description of the role that you provide.
  - Tags (list) --
    
    A list of tags that are attached to the specified role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
    - (dict) --
      
      A structure that represents user-provided metadata that can be associated with a resource such as an IAM user or role. For more information about tagging, see Tagging IAM Identities in the IAM User Guide.
      - Key (string) --
        
        The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
      - Value (string) --
        
        The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
        
        Note
        
        AWS always interprets the tag Value as a single string. If you need to store an array, you can store comma-separated values in the string. However, you must interpret the value in your code.
  - MaxSessionDuration (integer) --
    
    The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
  - PermissionsBoundary (dict) --
    
    The ARN of the policy used to set the permissions boundary for the role.
    
    For more information about permissions boundaries, see Permissions Boundaries for IAM Identities in the IAM User Guide.
    - PermissionsBoundaryType (string) --
      
      The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
    - PermissionsBoundaryArn (string) --
      
      The ARN of the policy used to set the permissions boundary for the user or role.