1. Docs
2. Reference
3. API
4. @pulumi/aws
5. iam

Module iam

namespace ManagedPolicies

• AdministratorAccess
• AmazonAPIGatewayAdministrator
• AmazonAPIGatewayInvokeFullAccess
• AmazonAPIGatewayPushToCloudWatchLogs
• AmazonAppStreamFullAccess
• AmazonAppStreamReadOnlyAccess
• AmazonAppStreamServiceAccess
• AmazonAthenaFullAccess
• AmazonCloudDirectoryFullAccess
• AmazonCloudDirectoryReadOnlyAccess
• AmazonCognitoDeveloperAuthenticatedIdentities
• AmazonCognitoPowerUser
• AmazonCognitoReadOnly
• AmazonDMSCloudWatchLogsRole
• AmazonDMSRedshiftS3Role
• AmazonDMSVPCManagementRole
• AmazonDRSVPCManagement
• AmazonDynamoDBFullAccess
• AmazonDynamoDBFullAccesswithDataPipeline
• AmazonDynamoDBReadOnlyAccess
• AmazonEC2ContainerRegistryFullAccess
• AmazonEC2ContainerRegistryPowerUser
• AmazonEC2ContainerRegistryReadOnly
• AmazonEC2ContainerServiceAutoscaleRole
• AmazonEC2ContainerServiceforEC2Role
• AmazonEC2ContainerServiceFullAccess
• AmazonEC2ContainerServiceRole
• AmazonEC2FullAccess
• AmazonEC2ReadOnlyAccess
• AmazonEC2ReportsAccess
• AmazonEC2RoleforAWSCodeDeploy
• AmazonEC2RoleforDataPipelineRole
• AmazonEC2RoleforSSM
• AmazonEC2SpotFleetAutoscaleRole
• AmazonEC2SpotFleetRole
• AmazonEC2SpotFleetTaggingRole
• AmazonElastiCacheFullAccess
• AmazonElastiCacheReadOnlyAccess
• AmazonElasticFileSystemFullAccess
• AmazonElasticFileSystemReadOnlyAccess
• AmazonElasticMapReduceforAutoScalingRole
• AmazonElasticMapReduceforEC2Role
• AmazonElasticMapReduceFullAccess
• AmazonElasticMapReduceReadOnlyAccess
• AmazonElasticMapReduceRole
• AmazonElasticTranscoderFullAccess
• AmazonElasticTranscoderJobsSubmitter
• AmazonElasticTranscoderReadOnlyAccess
• AmazonElasticTranscoderRole
• AmazonESFullAccess
• AmazonESReadOnlyAccess
• AmazonGlacierFullAccess
• AmazonGlacierReadOnlyAccess
• AmazonInspectorFullAccess
• AmazonInspectorReadOnlyAccess
• AmazonKinesisAnalyticsFullAccess
• AmazonKinesisAnalyticsReadOnly
• AmazonKinesisFirehoseFullAccess
• AmazonKinesisFirehoseReadOnlyAccess
• AmazonKinesisFullAccess
• AmazonKinesisReadOnlyAccess
• AmazonLexFullAccess
• AmazonLexReadOnly
• AmazonLexRunBotsOnly
• AmazonMachineLearningBatchPredictionsAccess
• AmazonMachineLearningCreateOnlyAccess
• AmazonMachineLearningFullAccess
• AmazonMachineLearningManageRealTimeEndpointOnlyAccess
• AmazonMachineLearningReadOnlyAccess
• AmazonMachineLearningRealTimePredictionOnlyAccess
• AmazonMachineLearningRoleforRedshiftDataSource
• AmazonMechanicalTurkFullAccess
• AmazonMechanicalTurkReadOnly
• AmazonMobileAnalyticsFinancialReportAccess
• AmazonMobileAnalyticsFullAccess
• AmazonMobileAnalyticsNonfinancialReportAccess
• AmazonMobileAnalyticsWriteOnlyAccess
• AmazonPollyFullAccess
• AmazonPollyReadOnlyAccess
• AmazonRDSDataFullAccess
• AmazonRDSDirectoryServiceAccess
• AmazonRDSEnhancedMonitoringRole
• AmazonRDSFullAccess
• AmazonRDSReadOnlyAccess
• AmazonRedshiftFullAccess
• AmazonRedshiftReadOnlyAccess
• AmazonRekognitionFullAccess
• AmazonRekognitionReadOnlyAccess
• AmazonRoute53DomainsFullAccess
• AmazonRoute53DomainsReadOnlyAccess
• AmazonRoute53FullAccess
• AmazonRoute53ReadOnlyAccess
• AmazonS3FullAccess
• AmazonS3ReadOnlyAccess
• AmazonSESFullAccess
• AmazonSESReadOnlyAccess
• AmazonSNSFullAccess
• AmazonSNSReadOnlyAccess
• AmazonSNSRole
• AmazonSQSFullAccess
• AmazonSQSReadOnlyAccess
• AmazonSSMAutomationRole
• AmazonSSMFullAccess
• AmazonSSMMaintenanceWindowRole
• AmazonSSMManagedInstanceCore
• AmazonSSMReadOnlyAccess
• AmazonVPCFullAccess
• AmazonVPCReadOnlyAccess
• AmazonWorkMailFullAccess
• AmazonWorkMailReadOnlyAccess
• AmazonWorkSpacesAdmin
• AmazonWorkSpacesApplicationManagerAdminAccess
• AmazonZocaloFullAccess
• AmazonZocaloReadOnlyAccess
• ApplicationAutoScalingForAmazonAppStreamAccess
• AutoScalingConsoleFullAccess
• AutoScalingConsoleReadOnlyAccess
• AutoScalingFullAccess
• AutoScalingNotificationAccessRole
• AutoScalingReadOnlyAccess
• AWSAccountActivityAccess
• AWSAccountUsageReportAccess
• AWSAgentlessDiscoveryService
• AWSApplicationDiscoveryAgentAccess
• AWSApplicationDiscoveryServiceFullAccess
• AWSBatchFullAccess
• AWSBatchServiceRole
• AWSCertificateManagerFullAccess
• AWSCertificateManagerReadOnly
• AWSCloudFormationReadOnlyAccess
• AWSCloudHSMFullAccess
• AWSCloudHSMReadOnlyAccess
• AWSCloudHSMRole
• AWSCloudTrailFullAccess
• AWSCloudTrailReadOnlyAccess
• AWSCodeBuildAdminAccess
• AWSCodeBuildDeveloperAccess
• AWSCodeBuildReadOnlyAccess
• AWSCodeCommitFullAccess
• AWSCodeCommitPowerUser
• AWSCodeCommitReadOnly
• AWSCodeDeployDeployerAccess
• AWSCodeDeployFullAccess
• AWSCodeDeployReadOnlyAccess
• AWSCodeDeployRole
• AWSCodeDeployRoleForECS
• AWSCodePipelineApproverAccess
• AWSCodePipelineCustomActionAccess
• AWSCodePipelineFullAccess
• AWSCodePipelineReadOnlyAccess
• AWSCodeStarFullAccess
• AWSCodeStarServiceRole
• AWSConfigRole
• AWSConfigRulesExecutionRole
• AWSConfigUserAccess
• AWSConnector
• AWSDataPipeline_FullAccess
• AWSDataPipeline_PowerUser
• AWSDataPipelineRole
• AWSDeviceFarmFullAccess
• AWSDirectConnectFullAccess
• AWSDirectConnectReadOnlyAccess
• AWSDirectoryServiceFullAccess
• AWSDirectoryServiceReadOnlyAccess
• AWSElasticBeanstalkCustomPlatformforEC2Role
• AWSElasticBeanstalkEnhancedHealth
• AWSElasticBeanstalkFullAccess
• AWSElasticBeanstalkMulticontainerDocker
• AWSElasticBeanstalkReadOnlyAccess
• AWSElasticBeanstalkService
• AWSElasticBeanstalkWebTier
• AWSElasticBeanstalkWorkerTier
• AWSGreengrassFullAccess
• AWSGreengrassResourceAccessRolePolicy
• AWSHealthFullAccess
• AWSImportExportFullAccess
• AWSImportExportReadOnlyAccess
• AWSIoTConfigAccess
• AWSIoTConfigReadOnlyAccess
• AWSIoTDataAccess
• AWSIoTFullAccess
• AWSIoTLogging
• AWSIoTRuleActions
• AWSKeyManagementServicePowerUser
• AWSLambdaBasicExecutionRole
• AWSLambdaDynamoDBExecutionRole
• AWSLambdaENIManagementAccess
• AWSLambdaExecute
• AWSLambdaFullAccess
• AWSLambdaInvocationDynamoDB
• AWSLambdaKinesisExecutionRole
• AWSLambdaReadOnlyAccess
• AWSLambdaRole
• AWSLambdaVPCAccessExecutionRole
• AWSMarketplaceFullAccess
• AWSMarketplaceGetEntitlements
• AWSMarketplaceManageSubscriptions
• AWSMarketplaceMeteringFullAccess
• AWSMarketplaceReadonly
• AWSMobileHub_FullAccess
• AWSMobileHub_ReadOnly
• AWSMobileHub_ServiceUseOnly
• AWSOpsWorksCloudWatchLogs
• AWSOpsWorksCMInstanceProfileRole
• AWSOpsWorksCMServiceRole
• AWSOpsWorksFullAccess
• AWSOpsWorksInstanceRegistration
• AWSOpsWorksRegisterCLI
• AWSOpsWorksRole
• AWSQuicksightAthenaAccess
• AWSQuickSightDescribeRDS
• AWSQuickSightDescribeRedshift
• AWSQuickSightListIAM
• AWSStepFunctionsConsoleFullAccess
• AWSStepFunctionsFullAccess
• AWSStepFunctionsReadOnlyAccess
• AWSStorageGatewayFullAccess
• AWSStorageGatewayReadOnlyAccess
• AWSSupportAccess
• AWSWAFFullAccess
• AWSWAFReadOnlyAccess
• AWSXRayDaemonWriteAccess
• AWSXrayFullAccess
• AWSXrayReadOnlyAccess
• AWSXrayWriteOnlyAccess
• Billing
• CloudFrontFullAccess
• CloudFrontReadOnlyAccess
• CloudSearchFullAccess
• CloudSearchReadOnlyAccess
• CloudWatchActionsEC2Access
• CloudWatchEventsBuiltInTargetExecutionAccess
• CloudWatchEventsFullAccess
• CloudWatchEventsInvocationAccess
• CloudWatchEventsReadOnlyAccess
• CloudWatchFullAccess
• CloudWatchLogsFullAccess
• CloudWatchLogsReadOnlyAccess
• CloudWatchReadOnlyAccess
• DatabaseAdministrator
• DataScientist
• IAMFullAccess
• IAMReadOnlyAccess
• IAMSelfManageServiceSpecificCredentials
• IAMUserChangePassword
• IAMUserSSHKeys
• NetworkAdministrator
• PowerUserAccess
• RDSCloudHsmAuthorizationRole
• ReadOnlyAccess
• ResourceGroupsandTagEditorFullAccess
• ResourceGroupsandTagEditorReadOnlyAccess
• SecurityAudit
• ServerMigrationConnector
• ServerMigrationServiceRole
• ServiceCatalogAdminFullAccess
• ServiceCatalogAdminReadOnlyAccess
• ServiceCatalogEndUserAccess
• ServiceCatalogEndUserFullAccess
• SimpleWorkflowFullAccess
• SupportUser
• SystemAdministrator
• ViewOnlyAccess
• VMImportExportRoleForAWSConnector

namespace Principals

• AcmServicePrincipal
• ApiGatewayPrincipal
• AthenaPrincipal
• AutoscalingPrincipal
• BatchPrincipal
• CloudDirectoryPrincipal
• CloudformationPrincipal
• CloudfrontPrincipal
• CloudSearchPrincipal
• CloudtrailPrincipal
• CodeBuildPrincipal
• CodeCommitPrincipal
• CodeDeployPrincipal
• CodePipelinePrincipal
• ConfigPrincipal
• DataPipelinePrincipal
• DirectConnectPrincipal
• DirectoryServicesPrincipal
• DynamoDbPrincipal
• Ec2Principal
• EcrPrincipal
• EcsPrincipal
• EcsTasksPrincipal
• EdgeLambdaPrincipal
• ElasticachePrincipal
• ElasticBeanstalkPrincipal
• ElasticFileSystemPrincipal
• ElasticLoadBalancingPrincipal
• ElasticMapReducePrincipal
• EventsPrincipal
• HealthPrincipal
• IamPrincipal
• InspectorPrincipal
• KinesisPrincipal
• KmsPrincipal
• LambdaPrincipal
• LightsailPrincipal
• LogsPrincipal
• MonitoringPrincipal
• OpsworksPrincipal
• OrganizationsPrincipal
• RdsPrincipal
• RedshiftPrincipal
• Route53Principal
• S3Principal
• ServiceCatalogPrincipal
• SesPrincipal
• SigninPrincipal
• SnsPrincipal
• SpotFleetPrincipal
• SqsPrincipal
• SsmPrincipal
• StorageGatewayPrincipal
• StsPrincipal
• SupportPrincipal
• VmiePrincipal
• VpcFlowLogsPrincipal
• WafPrincipal
• WorkDocsPrincipal
• WorkspacesPrincipal

Resources

• AccessKey
• AccountAlias
• AccountPasswordPolicy
• Group
• GroupMembership
• GroupPolicy
• GroupPolicyAttachment
• InstanceProfile
• OpenIdConnectProvider
• Policy
• PolicyAttachment
• Role
• RolePolicy
• RolePolicyAttachment
• SamlProvider
• ServerCertificate
• ServiceLinkedRole
• SshKey
• User
• UserGroupMembership
• UserLoginProfile
• UserPolicy
• UserPolicyAttachment

Functions

• getAccountAlias
• getGroup
• getInstanceProfile
• getPolicy
• getPolicyDocument
• getRole
• getServerCertificate
• getUser

Others

• AccessKeyArgs
• AccessKeyState
• AccountAliasArgs
• AccountAliasState
• AccountPasswordPolicyArgs
• AccountPasswordPolicyState
• assumeRolePolicyForPrincipal
• AWSPrincipal
• ConditionArguments
• Conditions
• FederatedPrincipal
• GetAccountAliasResult
• GetGroupArgs
• GetGroupResult
• GetInstanceProfileArgs
• GetInstanceProfileResult
• GetPolicyArgs
• GetPolicyDocumentArgs
• GetPolicyDocumentResult
• GetPolicyResult
• GetRoleArgs
• GetRoleResult
• GetServerCertificateArgs
• GetServerCertificateResult
• GetUserArgs
• GetUserResult
• GroupArgs
• GroupMembershipArgs
• GroupMembershipState
• GroupPolicyArgs
• GroupPolicyAttachmentArgs
• GroupPolicyAttachmentState
• GroupPolicyState
• GroupState
• InstanceProfileArgs
• InstanceProfileState
• OpenIdConnectProviderArgs
• OpenIdConnectProviderState
• PolicyArgs
• PolicyAttachmentArgs
• PolicyAttachmentState
• PolicyDocument
• PolicyState
• PolicyStatement
• Principal
• RoleArgs
• RolePolicyArgs
• RolePolicyAttachmentArgs
• RolePolicyAttachmentState
• RolePolicyState
• RoleState
• SamlProviderArgs
• SamlProviderState
• ServerCertificateArgs
• ServerCertificateState
• ServiceLinkedRoleArgs
• ServiceLinkedRoleState
• ServicePrincipal
• SshKeyArgs
• SshKeyState
• UserArgs
• UserGroupMembershipArgs
• UserGroupMembershipState
• UserLoginProfileArgs
• UserLoginProfileState
• UserPolicyArgs
• UserPolicyAttachmentArgs
• UserPolicyAttachmentState
• UserPolicyState
• UserState

namespace ManagedPolicies

const AdministratorAccess

const AdministratorAccess: ARN = "arn:aws:iam::aws:policy/AdministratorAccess";

const AmazonAPIGatewayAdministrator

const AmazonAPIGatewayAdministrator: ARN = "arn:aws:iam::aws:policy/AmazonAPIGatewayAdministrator";

const AmazonAPIGatewayInvokeFullAccess

const AmazonAPIGatewayInvokeFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess";

const AmazonAPIGatewayPushToCloudWatchLogs

const AmazonAPIGatewayPushToCloudWatchLogs: ARN = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs";

const AmazonAppStreamFullAccess

const AmazonAppStreamFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonAppStreamFullAccess";

const AmazonAppStreamReadOnlyAccess

const AmazonAppStreamReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonAppStreamReadOnlyAccess";

const AmazonAppStreamServiceAccess

const AmazonAppStreamServiceAccess: ARN = "arn:aws:iam::aws:policy/service-role/AmazonAppStreamServiceAccess";

const AmazonAthenaFullAccess

const AmazonAthenaFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonAthenaFullAccess";

const AmazonCloudDirectoryFullAccess

const AmazonCloudDirectoryFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonCloudDirectoryFullAccess";

const AmazonCloudDirectoryReadOnlyAccess

const AmazonCloudDirectoryReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonCloudDirectoryReadOnlyAccess";

const AmazonCognitoDeveloperAuthenticatedIdentities

const AmazonCognitoDeveloperAuthenticatedIdentities: ARN = "arn:aws:iam::aws:policy/AmazonCognitoDeveloperAuthenticatedIdentities";

const AmazonCognitoPowerUser

const AmazonCognitoPowerUser: ARN = "arn:aws:iam::aws:policy/AmazonCognitoPowerUser";

const AmazonCognitoReadOnly

const AmazonCognitoReadOnly: ARN = "arn:aws:iam::aws:policy/AmazonCognitoReadOnly";

const AmazonDMSCloudWatchLogsRole

const AmazonDMSCloudWatchLogsRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole";

const AmazonDMSRedshiftS3Role

const AmazonDMSRedshiftS3Role: ARN = "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role";

const AmazonDMSVPCManagementRole

const AmazonDMSVPCManagementRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole";

const AmazonDRSVPCManagement

const AmazonDRSVPCManagement: ARN = "arn:aws:iam::aws:policy/AmazonDRSVPCManagement";

const AmazonDynamoDBFullAccess

const AmazonDynamoDBFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess";

const AmazonDynamoDBFullAccesswithDataPipeline

const AmazonDynamoDBFullAccesswithDataPipeline: ARN = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline";

const AmazonDynamoDBReadOnlyAccess

const AmazonDynamoDBReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess";

const AmazonEC2ContainerRegistryFullAccess

const AmazonEC2ContainerRegistryFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess";

const AmazonEC2ContainerRegistryPowerUser

const AmazonEC2ContainerRegistryPowerUser: ARN = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser";

const AmazonEC2ContainerRegistryReadOnly

const AmazonEC2ContainerRegistryReadOnly: ARN = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly";

const AmazonEC2ContainerServiceAutoscaleRole

const AmazonEC2ContainerServiceAutoscaleRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceAutoscaleRole";

const AmazonEC2ContainerServiceforEC2Role

const AmazonEC2ContainerServiceforEC2Role: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role";

const AmazonEC2ContainerServiceFullAccess

const AmazonEC2ContainerServiceFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess";

const AmazonEC2ContainerServiceRole

const AmazonEC2ContainerServiceRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole";

const AmazonEC2FullAccess

const AmazonEC2FullAccess: ARN = "arn:aws:iam::aws:policy/AmazonEC2FullAccess";

const AmazonEC2ReadOnlyAccess

const AmazonEC2ReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess";

const AmazonEC2ReportsAccess

const AmazonEC2ReportsAccess: ARN = "arn:aws:iam::aws:policy/AmazonEC2ReportsAccess";

const AmazonEC2RoleforAWSCodeDeploy

const AmazonEC2RoleforAWSCodeDeploy: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforAWSCodeDeploy";

const AmazonEC2RoleforDataPipelineRole

const AmazonEC2RoleforDataPipelineRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole";

const AmazonEC2RoleforSSM

const AmazonEC2RoleforSSM: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM";

const AmazonEC2SpotFleetAutoscaleRole

const AmazonEC2SpotFleetAutoscaleRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetAutoscaleRole";

const AmazonEC2SpotFleetRole

const AmazonEC2SpotFleetRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetRole";

const AmazonEC2SpotFleetTaggingRole

const AmazonEC2SpotFleetTaggingRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonEC2SpotFleetTaggingRole";

const AmazonElastiCacheFullAccess

const AmazonElastiCacheFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess";

const AmazonElastiCacheReadOnlyAccess

const AmazonElastiCacheReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonElastiCacheReadOnlyAccess";

const AmazonElasticFileSystemFullAccess

const AmazonElasticFileSystemFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess";

const AmazonElasticFileSystemReadOnlyAccess

const AmazonElasticFileSystemReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticFileSystemReadOnlyAccess";

const AmazonElasticMapReduceforAutoScalingRole

const AmazonElasticMapReduceforAutoScalingRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole";

const AmazonElasticMapReduceforEC2Role

const AmazonElasticMapReduceforEC2Role: ARN = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role";

const AmazonElasticMapReduceFullAccess

const AmazonElasticMapReduceFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticMapReduceFullAccess";

const AmazonElasticMapReduceReadOnlyAccess

const AmazonElasticMapReduceReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticMapReduceReadOnlyAccess";

const AmazonElasticMapReduceRole

const AmazonElasticMapReduceRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole";

const AmazonElasticTranscoderFullAccess

const AmazonElasticTranscoderFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticTranscoderFullAccess";

const AmazonElasticTranscoderJobsSubmitter

const AmazonElasticTranscoderJobsSubmitter: ARN = "arn:aws:iam::aws:policy/AmazonElasticTranscoderJobsSubmitter";

const AmazonElasticTranscoderReadOnlyAccess

const AmazonElasticTranscoderReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonElasticTranscoderReadOnlyAccess";

const AmazonElasticTranscoderRole

const AmazonElasticTranscoderRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonElasticTranscoderRole";

const AmazonESFullAccess

const AmazonESFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonESFullAccess";

const AmazonESReadOnlyAccess

const AmazonESReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonESReadOnlyAccess";

const AmazonGlacierFullAccess

const AmazonGlacierFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonGlacierFullAccess";

const AmazonGlacierReadOnlyAccess

const AmazonGlacierReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonGlacierReadOnlyAccess";

const AmazonInspectorFullAccess

const AmazonInspectorFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonInspectorFullAccess";

const AmazonInspectorReadOnlyAccess

const AmazonInspectorReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonInspectorReadOnlyAccess";

const AmazonKinesisAnalyticsFullAccess

const AmazonKinesisAnalyticsFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonKinesisAnalyticsFullAccess";

const AmazonKinesisAnalyticsReadOnly

const AmazonKinesisAnalyticsReadOnly: ARN = "arn:aws:iam::aws:policy/AmazonKinesisAnalyticsReadOnly";

const AmazonKinesisFirehoseFullAccess

const AmazonKinesisFirehoseFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonKinesisFirehoseFullAccess";

const AmazonKinesisFirehoseReadOnlyAccess

const AmazonKinesisFirehoseReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonKinesisFirehoseReadOnlyAccess";

const AmazonKinesisFullAccess

const AmazonKinesisFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonKinesisFullAccess";

const AmazonKinesisReadOnlyAccess

const AmazonKinesisReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonKinesisReadOnlyAccess";

const AmazonLexFullAccess

const AmazonLexFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonLexFullAccess";

const AmazonLexReadOnly

const AmazonLexReadOnly: ARN = "arn:aws:iam::aws:policy/AmazonLexReadOnly";

const AmazonLexRunBotsOnly

const AmazonLexRunBotsOnly: ARN = "arn:aws:iam::aws:policy/AmazonLexRunBotsOnly";

const AmazonMachineLearningBatchPredictionsAccess

const AmazonMachineLearningBatchPredictionsAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningBatchPredictionsAccess";

const AmazonMachineLearningCreateOnlyAccess

const AmazonMachineLearningCreateOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningCreateOnlyAccess";

const AmazonMachineLearningFullAccess

const AmazonMachineLearningFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningFullAccess";

const AmazonMachineLearningManageRealTimeEndpointOnlyAccess

const AmazonMachineLearningManageRealTimeEndpointOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningManageRealTimeEndpointOnlyAccess";

const AmazonMachineLearningReadOnlyAccess

const AmazonMachineLearningReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningReadOnlyAccess";

const AmazonMachineLearningRealTimePredictionOnlyAccess

const AmazonMachineLearningRealTimePredictionOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonMachineLearningRealTimePredictionOnlyAccess";

const AmazonMachineLearningRoleforRedshiftDataSource

const AmazonMachineLearningRoleforRedshiftDataSource: ARN = "arn:aws:iam::aws:policy/service-role/AmazonMachineLearningRoleforRedshiftDataSource";

const AmazonMechanicalTurkFullAccess

const AmazonMechanicalTurkFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonMechanicalTurkFullAccess";

const AmazonMechanicalTurkReadOnly

const AmazonMechanicalTurkReadOnly: ARN = "arn:aws:iam::aws:policy/AmazonMechanicalTurkReadOnly";

const AmazonMobileAnalyticsFinancialReportAccess

const AmazonMobileAnalyticsFinancialReportAccess: ARN = "arn:aws:iam::aws:policy/AmazonMobileAnalyticsFinancialReportAccess";

const AmazonMobileAnalyticsFullAccess

const AmazonMobileAnalyticsFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonMobileAnalyticsFullAccess";

const AmazonMobileAnalyticsNonfinancialReportAccess

const AmazonMobileAnalyticsNonfinancialReportAccess: ARN = "arn:aws:iam::aws:policy/AmazonMobileAnalyticsNon-financialReportAccess";

const AmazonMobileAnalyticsWriteOnlyAccess

const AmazonMobileAnalyticsWriteOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonMobileAnalyticsWriteOnlyAccess";

const AmazonPollyFullAccess

const AmazonPollyFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonPollyFullAccess";

const AmazonPollyReadOnlyAccess

const AmazonPollyReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonPollyReadOnlyAccess";

const AmazonRDSDataFullAccess

const AmazonRDSDataFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRDSDataFullAccess";

const AmazonRDSDirectoryServiceAccess

const AmazonRDSDirectoryServiceAccess: ARN = "arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess";

const AmazonRDSEnhancedMonitoringRole

const AmazonRDSEnhancedMonitoringRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole";

const AmazonRDSFullAccess

const AmazonRDSFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRDSFullAccess";

const AmazonRDSReadOnlyAccess

const AmazonRDSReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess";

const AmazonRedshiftFullAccess

const AmazonRedshiftFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess";

const AmazonRedshiftReadOnlyAccess

const AmazonRedshiftReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonRedshiftReadOnlyAccess";

const AmazonRekognitionFullAccess

const AmazonRekognitionFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRekognitionFullAccess";

const AmazonRekognitionReadOnlyAccess

const AmazonRekognitionReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonRekognitionReadOnlyAccess";

const AmazonRoute53DomainsFullAccess

const AmazonRoute53DomainsFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRoute53DomainsFullAccess";

const AmazonRoute53DomainsReadOnlyAccess

const AmazonRoute53DomainsReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonRoute53DomainsReadOnlyAccess";

const AmazonRoute53FullAccess

const AmazonRoute53FullAccess: ARN = "arn:aws:iam::aws:policy/AmazonRoute53FullAccess";

const AmazonRoute53ReadOnlyAccess

const AmazonRoute53ReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonRoute53ReadOnlyAccess";

const AmazonS3FullAccess

const AmazonS3FullAccess: ARN = "arn:aws:iam::aws:policy/AmazonS3FullAccess";

const AmazonS3ReadOnlyAccess

const AmazonS3ReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess";

const AmazonSESFullAccess

const AmazonSESFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonSESFullAccess";

const AmazonSESReadOnlyAccess

const AmazonSESReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonSESReadOnlyAccess";

const AmazonSNSFullAccess

const AmazonSNSFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonSNSFullAccess";

const AmazonSNSReadOnlyAccess

const AmazonSNSReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess";

const AmazonSNSRole

const AmazonSNSRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonSNSRole";

const AmazonSQSFullAccess

const AmazonSQSFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonSQSFullAccess";

const AmazonSQSReadOnlyAccess

const AmazonSQSReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess";

const AmazonSSMAutomationRole

const AmazonSSMAutomationRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole";

const AmazonSSMFullAccess

const AmazonSSMFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonSSMFullAccess";

const AmazonSSMMaintenanceWindowRole

const AmazonSSMMaintenanceWindowRole: ARN = "arn:aws:iam::aws:policy/service-role/AmazonSSMMaintenanceWindowRole";

const AmazonSSMManagedInstanceCore

const AmazonSSMManagedInstanceCore: ARN = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore";

const AmazonSSMReadOnlyAccess

const AmazonSSMReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess";

const AmazonVPCFullAccess

const AmazonVPCFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonVPCFullAccess";

const AmazonVPCReadOnlyAccess

const AmazonVPCReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess";

const AmazonWorkMailFullAccess

const AmazonWorkMailFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonWorkMailFullAccess";

const AmazonWorkMailReadOnlyAccess

const AmazonWorkMailReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonWorkMailReadOnlyAccess";

const AmazonWorkSpacesAdmin

const AmazonWorkSpacesAdmin: ARN = "arn:aws:iam::aws:policy/AmazonWorkSpacesAdmin";

const AmazonWorkSpacesApplicationManagerAdminAccess

const AmazonWorkSpacesApplicationManagerAdminAccess: ARN = "arn:aws:iam::aws:policy/AmazonWorkSpacesApplicationManagerAdminAccess";

const AmazonZocaloFullAccess

const AmazonZocaloFullAccess: ARN = "arn:aws:iam::aws:policy/AmazonZocaloFullAccess";

const AmazonZocaloReadOnlyAccess

const AmazonZocaloReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AmazonZocaloReadOnlyAccess";

const ApplicationAutoScalingForAmazonAppStreamAccess

const ApplicationAutoScalingForAmazonAppStreamAccess: ARN = "arn:aws:iam::aws:policy/service-role/ApplicationAutoScalingForAmazonAppStreamAccess";

const AutoScalingConsoleFullAccess

const AutoScalingConsoleFullAccess: ARN = "arn:aws:iam::aws:policy/AutoScalingConsoleFullAccess";

const AutoScalingConsoleReadOnlyAccess

const AutoScalingConsoleReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AutoScalingConsoleReadOnlyAccess";

const AutoScalingFullAccess

const AutoScalingFullAccess: ARN = "arn:aws:iam::aws:policy/AutoScalingFullAccess";

const AutoScalingNotificationAccessRole

const AutoScalingNotificationAccessRole: ARN = "arn:aws:iam::aws:policy/service-role/AutoScalingNotificationAccessRole";

const AutoScalingReadOnlyAccess

const AutoScalingReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess";

const AWSAccountActivityAccess

const AWSAccountActivityAccess: ARN = "arn:aws:iam::aws:policy/AWSAccountActivityAccess";

const AWSAccountUsageReportAccess

const AWSAccountUsageReportAccess: ARN = "arn:aws:iam::aws:policy/AWSAccountUsageReportAccess";

const AWSAgentlessDiscoveryService

const AWSAgentlessDiscoveryService: ARN = "arn:aws:iam::aws:policy/AWSAgentlessDiscoveryService";

const AWSApplicationDiscoveryAgentAccess

const AWSApplicationDiscoveryAgentAccess: ARN = "arn:aws:iam::aws:policy/AWSApplicationDiscoveryAgentAccess";

const AWSApplicationDiscoveryServiceFullAccess

const AWSApplicationDiscoveryServiceFullAccess: ARN = "arn:aws:iam::aws:policy/AWSApplicationDiscoveryServiceFullAccess";

const AWSBatchFullAccess

const AWSBatchFullAccess: ARN = "arn:aws:iam::aws:policy/AWSBatchFullAccess";

const AWSBatchServiceRole

const AWSBatchServiceRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole";

const AWSCertificateManagerFullAccess

const AWSCertificateManagerFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess";

const AWSCertificateManagerReadOnly

const AWSCertificateManagerReadOnly: ARN = "arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly";

const AWSCloudFormationReadOnlyAccess

const AWSCloudFormationReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess";

const AWSCloudHSMFullAccess

const AWSCloudHSMFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCloudHSMFullAccess";

const AWSCloudHSMReadOnlyAccess

const AWSCloudHSMReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCloudHSMReadOnlyAccess";

const AWSCloudHSMRole

const AWSCloudHSMRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSCloudHSMRole";

const AWSCloudTrailFullAccess

const AWSCloudTrailFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCloudTrailFullAccess";

const AWSCloudTrailReadOnlyAccess

const AWSCloudTrailReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCloudTrailReadOnlyAccess";

const AWSCodeBuildAdminAccess

const AWSCodeBuildAdminAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess";

const AWSCodeBuildDeveloperAccess

const AWSCodeBuildDeveloperAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess";

const AWSCodeBuildReadOnlyAccess

const AWSCodeBuildReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeBuildReadOnlyAccess";

const AWSCodeCommitFullAccess

const AWSCodeCommitFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess";

const AWSCodeCommitPowerUser

const AWSCodeCommitPowerUser: ARN = "arn:aws:iam::aws:policy/AWSCodeCommitPowerUser";

const AWSCodeCommitReadOnly

const AWSCodeCommitReadOnly: ARN = "arn:aws:iam::aws:policy/AWSCodeCommitReadOnly";

const AWSCodeDeployDeployerAccess

const AWSCodeDeployDeployerAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeDeployDeployerAccess";

const AWSCodeDeployFullAccess

const AWSCodeDeployFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess";

const AWSCodeDeployReadOnlyAccess

const AWSCodeDeployReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeDeployReadOnlyAccess";

const AWSCodeDeployRole

const AWSCodeDeployRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole";

const AWSCodeDeployRoleForECS

const AWSCodeDeployRoleForECS: ARN = "arn:aws:iam::aws:policy/AWSCodeDeployRoleForECS";

const AWSCodePipelineApproverAccess

const AWSCodePipelineApproverAccess: ARN = "arn:aws:iam::aws:policy/AWSCodePipelineApproverAccess";

const AWSCodePipelineCustomActionAccess

const AWSCodePipelineCustomActionAccess: ARN = "arn:aws:iam::aws:policy/AWSCodePipelineCustomActionAccess";

const AWSCodePipelineFullAccess

const AWSCodePipelineFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess";

const AWSCodePipelineReadOnlyAccess

const AWSCodePipelineReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSCodePipelineReadOnlyAccess";

const AWSCodeStarFullAccess

const AWSCodeStarFullAccess: ARN = "arn:aws:iam::aws:policy/AWSCodeStarFullAccess";

const AWSCodeStarServiceRole

const AWSCodeStarServiceRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSCodeStarServiceRole";

const AWSConfigRole

const AWSConfigRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSConfigRole";

const AWSConfigRulesExecutionRole

const AWSConfigRulesExecutionRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole";

const AWSConfigUserAccess

const AWSConfigUserAccess: ARN = "arn:aws:iam::aws:policy/AWSConfigUserAccess";

const AWSConnector

const AWSConnector: ARN = "arn:aws:iam::aws:policy/AWSConnector";

const AWSDataPipeline_FullAccess

const AWSDataPipeline_FullAccess: ARN = "arn:aws:iam::aws:policy/AWSDataPipeline_FullAccess";

const AWSDataPipeline_PowerUser

const AWSDataPipeline_PowerUser: ARN = "arn:aws:iam::aws:policy/AWSDataPipeline_PowerUser";

const AWSDataPipelineRole

const AWSDataPipelineRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSDataPipelineRole";

const AWSDeviceFarmFullAccess

const AWSDeviceFarmFullAccess: ARN = "arn:aws:iam::aws:policy/AWSDeviceFarmFullAccess";

const AWSDirectConnectFullAccess

const AWSDirectConnectFullAccess: ARN = "arn:aws:iam::aws:policy/AWSDirectConnectFullAccess";

const AWSDirectConnectReadOnlyAccess

const AWSDirectConnectReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSDirectConnectReadOnlyAccess";

const AWSDirectoryServiceFullAccess

const AWSDirectoryServiceFullAccess: ARN = "arn:aws:iam::aws:policy/AWSDirectoryServiceFullAccess";

const AWSDirectoryServiceReadOnlyAccess

const AWSDirectoryServiceReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSDirectoryServiceReadOnlyAccess";

const AWSElasticBeanstalkCustomPlatformforEC2Role

const AWSElasticBeanstalkCustomPlatformforEC2Role: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkCustomPlatformforEC2Role";

const AWSElasticBeanstalkEnhancedHealth

const AWSElasticBeanstalkEnhancedHealth: ARN = "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth";

const AWSElasticBeanstalkFullAccess

const AWSElasticBeanstalkFullAccess: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkFullAccess";

const AWSElasticBeanstalkMulticontainerDocker

const AWSElasticBeanstalkMulticontainerDocker: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker";

const AWSElasticBeanstalkReadOnlyAccess

const AWSElasticBeanstalkReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkReadOnlyAccess";

const AWSElasticBeanstalkService

const AWSElasticBeanstalkService: ARN = "arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkService";

const AWSElasticBeanstalkWebTier

const AWSElasticBeanstalkWebTier: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier";

const AWSElasticBeanstalkWorkerTier

const AWSElasticBeanstalkWorkerTier: ARN = "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier";

const AWSGreengrassFullAccess

const AWSGreengrassFullAccess: ARN = "arn:aws:iam::aws:policy/AWSGreengrassFullAccess";

const AWSGreengrassResourceAccessRolePolicy

const AWSGreengrassResourceAccessRolePolicy: ARN = "arn:aws:iam::aws:policy/service-role/AWSGreengrassResourceAccessRolePolicy";

const AWSHealthFullAccess

const AWSHealthFullAccess: ARN = "arn:aws:iam::aws:policy/AWSHealthFullAccess";

const AWSImportExportFullAccess

const AWSImportExportFullAccess: ARN = "arn:aws:iam::aws:policy/AWSImportExportFullAccess";

const AWSImportExportReadOnlyAccess

const AWSImportExportReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSImportExportReadOnlyAccess";

const AWSIoTConfigAccess

const AWSIoTConfigAccess: ARN = "arn:aws:iam::aws:policy/AWSIoTConfigAccess";

const AWSIoTConfigReadOnlyAccess

const AWSIoTConfigReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSIoTConfigReadOnlyAccess";

const AWSIoTDataAccess

const AWSIoTDataAccess: ARN = "arn:aws:iam::aws:policy/AWSIoTDataAccess";

const AWSIoTFullAccess

const AWSIoTFullAccess: ARN = "arn:aws:iam::aws:policy/AWSIoTFullAccess";

const AWSIoTLogging

const AWSIoTLogging: ARN = "arn:aws:iam::aws:policy/service-role/AWSIoTLogging";

const AWSIoTRuleActions

const AWSIoTRuleActions: ARN = "arn:aws:iam::aws:policy/service-role/AWSIoTRuleActions";

const AWSKeyManagementServicePowerUser

const AWSKeyManagementServicePowerUser: ARN = "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser";

const AWSLambdaBasicExecutionRole

const AWSLambdaBasicExecutionRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole";

const AWSLambdaDynamoDBExecutionRole

const AWSLambdaDynamoDBExecutionRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole";

const AWSLambdaENIManagementAccess

const AWSLambdaENIManagementAccess: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess";

const AWSLambdaExecute

const AWSLambdaExecute: ARN = "arn:aws:iam::aws:policy/AWSLambdaExecute";

const AWSLambdaFullAccess

const AWSLambdaFullAccess: ARN = "arn:aws:iam::aws:policy/AWSLambdaFullAccess";

const AWSLambdaInvocationDynamoDB

const AWSLambdaInvocationDynamoDB: ARN = "arn:aws:iam::aws:policy/AWSLambdaInvocation-DynamoDB";

const AWSLambdaKinesisExecutionRole

const AWSLambdaKinesisExecutionRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole";

const AWSLambdaReadOnlyAccess

const AWSLambdaReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSLambdaReadOnlyAccess";

const AWSLambdaRole

const AWSLambdaRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaRole";

const AWSLambdaVPCAccessExecutionRole

const AWSLambdaVPCAccessExecutionRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole";

const AWSMarketplaceFullAccess

const AWSMarketplaceFullAccess: ARN = "arn:aws:iam::aws:policy/AWSMarketplaceFullAccess";

const AWSMarketplaceGetEntitlements

const AWSMarketplaceGetEntitlements: ARN = "arn:aws:iam::aws:policy/AWSMarketplaceGetEntitlements";

const AWSMarketplaceManageSubscriptions

const AWSMarketplaceManageSubscriptions: ARN = "arn:aws:iam::aws:policy/AWSMarketplaceManageSubscriptions";

const AWSMarketplaceMeteringFullAccess

const AWSMarketplaceMeteringFullAccess: ARN = "arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess";

const AWSMarketplaceReadonly

const AWSMarketplaceReadonly: ARN = "arn:aws:iam::aws:policy/AWSMarketplaceRead-only";

const AWSMobileHub_FullAccess

const AWSMobileHub_FullAccess: ARN = "arn:aws:iam::aws:policy/AWSMobileHub_FullAccess";

const AWSMobileHub_ReadOnly

const AWSMobileHub_ReadOnly: ARN = "arn:aws:iam::aws:policy/AWSMobileHub_ReadOnly";

const AWSMobileHub_ServiceUseOnly

const AWSMobileHub_ServiceUseOnly: ARN = "arn:aws:iam::aws:policy/service-role/AWSMobileHub_ServiceUseOnly";

const AWSOpsWorksCloudWatchLogs

const AWSOpsWorksCloudWatchLogs: ARN = "arn:aws:iam::aws:policy/AWSOpsWorksCloudWatchLogs";

const AWSOpsWorksCMInstanceProfileRole

const AWSOpsWorksCMInstanceProfileRole: ARN = "arn:aws:iam::aws:policy/AWSOpsWorksCMInstanceProfileRole";

const AWSOpsWorksCMServiceRole

const AWSOpsWorksCMServiceRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSOpsWorksCMServiceRole";

const AWSOpsWorksFullAccess

const AWSOpsWorksFullAccess: ARN = "arn:aws:iam::aws:policy/AWSOpsWorksFullAccess";

const AWSOpsWorksInstanceRegistration

const AWSOpsWorksInstanceRegistration: ARN = "arn:aws:iam::aws:policy/AWSOpsWorksInstanceRegistration";

const AWSOpsWorksRegisterCLI

const AWSOpsWorksRegisterCLI: ARN = "arn:aws:iam::aws:policy/AWSOpsWorksRegisterCLI";

const AWSOpsWorksRole

const AWSOpsWorksRole: ARN = "arn:aws:iam::aws:policy/service-role/AWSOpsWorksRole";

const AWSQuicksightAthenaAccess

const AWSQuicksightAthenaAccess: ARN = "arn:aws:iam::aws:policy/service-role/AWSQuicksightAthenaAccess";

const AWSQuickSightDescribeRDS

const AWSQuickSightDescribeRDS: ARN = "arn:aws:iam::aws:policy/service-role/AWSQuickSightDescribeRDS";

const AWSQuickSightDescribeRedshift

const AWSQuickSightDescribeRedshift: ARN = "arn:aws:iam::aws:policy/service-role/AWSQuickSightDescribeRedshift";

const AWSQuickSightListIAM

const AWSQuickSightListIAM: ARN = "arn:aws:iam::aws:policy/service-role/AWSQuickSightListIAM";

const AWSStepFunctionsConsoleFullAccess

const AWSStepFunctionsConsoleFullAccess: ARN = "arn:aws:iam::aws:policy/AWSStepFunctionsConsoleFullAccess";

const AWSStepFunctionsFullAccess

const AWSStepFunctionsFullAccess: ARN = "arn:aws:iam::aws:policy/AWSStepFunctionsFullAccess";

const AWSStepFunctionsReadOnlyAccess

const AWSStepFunctionsReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSStepFunctionsReadOnlyAccess";

const AWSStorageGatewayFullAccess

const AWSStorageGatewayFullAccess: ARN = "arn:aws:iam::aws:policy/AWSStorageGatewayFullAccess";

const AWSStorageGatewayReadOnlyAccess

const AWSStorageGatewayReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSStorageGatewayReadOnlyAccess";

const AWSSupportAccess

const AWSSupportAccess: ARN = "arn:aws:iam::aws:policy/AWSSupportAccess";

const AWSWAFFullAccess

const AWSWAFFullAccess: ARN = "arn:aws:iam::aws:policy/AWSWAFFullAccess";

const AWSWAFReadOnlyAccess

const AWSWAFReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess";

const AWSXRayDaemonWriteAccess

const AWSXRayDaemonWriteAccess: ARN = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess";

const AWSXrayFullAccess

const AWSXrayFullAccess: ARN = "arn:aws:iam::aws:policy/AWSXrayFullAccess";

const AWSXrayReadOnlyAccess

const AWSXrayReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess";

const AWSXrayWriteOnlyAccess

const AWSXrayWriteOnlyAccess: ARN = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess";

const Billing

const Billing: ARN = "arn:aws:iam::aws:policy/job-function/Billing";

const CloudFrontFullAccess

const CloudFrontFullAccess: ARN = "arn:aws:iam::aws:policy/CloudFrontFullAccess";

const CloudFrontReadOnlyAccess

const CloudFrontReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/CloudFrontReadOnlyAccess";

const CloudSearchFullAccess

const CloudSearchFullAccess: ARN = "arn:aws:iam::aws:policy/CloudSearchFullAccess";

const CloudSearchReadOnlyAccess

const CloudSearchReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/CloudSearchReadOnlyAccess";

const CloudWatchActionsEC2Access

const CloudWatchActionsEC2Access: ARN = "arn:aws:iam::aws:policy/CloudWatchActionsEC2Access";

const CloudWatchEventsBuiltInTargetExecutionAccess

const CloudWatchEventsBuiltInTargetExecutionAccess: ARN = "arn:aws:iam::aws:policy/service-role/CloudWatchEventsBuiltInTargetExecutionAccess";

const CloudWatchEventsFullAccess

const CloudWatchEventsFullAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchEventsFullAccess";

const CloudWatchEventsInvocationAccess

const CloudWatchEventsInvocationAccess: ARN = "arn:aws:iam::aws:policy/service-role/CloudWatchEventsInvocationAccess";

const CloudWatchEventsReadOnlyAccess

const CloudWatchEventsReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchEventsReadOnlyAccess";

const CloudWatchFullAccess

const CloudWatchFullAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchFullAccess";

const CloudWatchLogsFullAccess

const CloudWatchLogsFullAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess";

const CloudWatchLogsReadOnlyAccess

const CloudWatchLogsReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess";

const CloudWatchReadOnlyAccess

const CloudWatchReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess";

const DatabaseAdministrator

const DatabaseAdministrator: ARN = "arn:aws:iam::aws:policy/job-function/DatabaseAdministrator";

const DataScientist

const DataScientist: ARN = "arn:aws:iam::aws:policy/job-function/DataScientist";

const IAMFullAccess

const IAMFullAccess: ARN = "arn:aws:iam::aws:policy/IAMFullAccess";

const IAMReadOnlyAccess

const IAMReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/IAMReadOnlyAccess";

const IAMSelfManageServiceSpecificCredentials

const IAMSelfManageServiceSpecificCredentials: ARN = "arn:aws:iam::aws:policy/IAMSelfManageServiceSpecificCredentials";

const IAMUserChangePassword

const IAMUserChangePassword: ARN = "arn:aws:iam::aws:policy/IAMUserChangePassword";

const IAMUserSSHKeys

const IAMUserSSHKeys: ARN = "arn:aws:iam::aws:policy/IAMUserSSHKeys";

const NetworkAdministrator

const NetworkAdministrator: ARN = "arn:aws:iam::aws:policy/job-function/NetworkAdministrator";

const PowerUserAccess

const PowerUserAccess: ARN = "arn:aws:iam::aws:policy/PowerUserAccess";

const RDSCloudHsmAuthorizationRole

const RDSCloudHsmAuthorizationRole: ARN = "arn:aws:iam::aws:policy/service-role/RDSCloudHsmAuthorizationRole";

const ReadOnlyAccess

const ReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/ReadOnlyAccess";

const ResourceGroupsandTagEditorFullAccess

const ResourceGroupsandTagEditorFullAccess: ARN = "arn:aws:iam::aws:policy/ResourceGroupsandTagEditorFullAccess";

const ResourceGroupsandTagEditorReadOnlyAccess

const ResourceGroupsandTagEditorReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/ResourceGroupsandTagEditorReadOnlyAccess";

const SecurityAudit

const SecurityAudit: ARN = "arn:aws:iam::aws:policy/SecurityAudit";

const ServerMigrationConnector

const ServerMigrationConnector: ARN = "arn:aws:iam::aws:policy/ServerMigrationConnector";

const ServerMigrationServiceRole

const ServerMigrationServiceRole: ARN = "arn:aws:iam::aws:policy/service-role/ServerMigrationServiceRole";

const ServiceCatalogAdminFullAccess

const ServiceCatalogAdminFullAccess: ARN = "arn:aws:iam::aws:policy/ServiceCatalogAdminFullAccess";

const ServiceCatalogAdminReadOnlyAccess

const ServiceCatalogAdminReadOnlyAccess: ARN = "arn:aws:iam::aws:policy/ServiceCatalogAdminReadOnlyAccess";

const ServiceCatalogEndUserAccess

const ServiceCatalogEndUserAccess: ARN = "arn:aws:iam::aws:policy/ServiceCatalogEndUserAccess";

const ServiceCatalogEndUserFullAccess

const ServiceCatalogEndUserFullAccess: ARN = "arn:aws:iam::aws:policy/ServiceCatalogEndUserFullAccess";

const SimpleWorkflowFullAccess

const SimpleWorkflowFullAccess: ARN = "arn:aws:iam::aws:policy/SimpleWorkflowFullAccess";

const SupportUser

const SupportUser: ARN = "arn:aws:iam::aws:policy/job-function/SupportUser";

const SystemAdministrator

const SystemAdministrator: ARN = "arn:aws:iam::aws:policy/job-function/SystemAdministrator";

const ViewOnlyAccess

const ViewOnlyAccess: ARN = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess";

const VMImportExportRoleForAWSConnector

const VMImportExportRoleForAWSConnector: ARN = "arn:aws:iam::aws:policy/service-role/VMImportExportRoleForAWSConnector";

namespace Principals

const AcmServicePrincipal

Service Principal for Amazon Certificate Manager

let Service

let Service: string = "acm.amazonaws.com";

const ApiGatewayPrincipal

let Service

let Service: string = "apigateway.amazonaws.com";

const AthenaPrincipal

let Service

let Service: string = "athena.amazonaws.com";

const AutoscalingPrincipal

let Service

let Service: string = "autoscaling.amazonaws.com";

const BatchPrincipal

let Service

let Service: string = "batch.amazonaws.com";

const CloudDirectoryPrincipal

let Service

let Service: string = "clouddirectory.amazonaws.com";

const CloudformationPrincipal

let Service

let Service: string = "cloudformation.amazonaws.com";

const CloudfrontPrincipal

let Service

let Service: string = "cloudfront.amazonaws.com";

const CloudSearchPrincipal

let Service

let Service: string = "cloudsearch.amazonaws.com";

const CloudtrailPrincipal

let Service

let Service: string = "cloudtrail.amazonaws.com";

const CodeBuildPrincipal

let Service

let Service: string = "codebuild.amazonaws.com";

const CodeCommitPrincipal

let Service

let Service: string = "codecommit.amazonaws.com";

const CodeDeployPrincipal

let Service

let Service: string = "codedeploy.amazonaws.com";

const CodePipelinePrincipal

let Service

let Service: string = "codepipeline.amazonaws.com";

const ConfigPrincipal

let Service

let Service: string = "config.amazonaws.com";

const DataPipelinePrincipal

let Service

let Service: string = "datapipeline.amazonaws.com";

const DirectConnectPrincipal

let Service

let Service: string = "directconnect.amazonaws.com";

const DirectoryServicesPrincipal

let Service

let Service: string = "ds.amazonaws.com";

const DynamoDbPrincipal

let Service

let Service: string = "dynamodb.amazonaws.com";

const Ec2Principal

let Service

let Service: string = "ec2.amazonaws.com";

const EcrPrincipal

let Service

let Service: string = "ecr.amazonaws.com";

const EcsPrincipal

let Service

let Service: string = "ecs.amazonaws.com";

const EcsTasksPrincipal

let Service

let Service: string = "ecs-tasks.amazonaws.com";

const EdgeLambdaPrincipal

let Service

let Service: string = "edgelambda.amazonaws.com";

const ElasticachePrincipal

let Service

let Service: string = "elasticache.amazonaws.com";

const ElasticBeanstalkPrincipal

let Service

let Service: string = "elasticbeanstalk.amazonaws.com";

const ElasticFileSystemPrincipal

let Service

let Service: string = "elasticfilesystem.amazonaws.com";

const ElasticLoadBalancingPrincipal

let Service

let Service: string = "elasticloadbalancing.amazonaws.com";

const ElasticMapReducePrincipal

let Service

let Service: string = "elasticmapreduce.amazonaws.com";

const EventsPrincipal

let Service

let Service: string = "events.amazonaws.com";

const HealthPrincipal

let Service

let Service: string = "health.amazonaws.com";

const IamPrincipal

let Service

let Service: string = "iam.amazonaws.com";

const InspectorPrincipal

let Service

let Service: string = "inspector.amazonaws.com";

const KinesisPrincipal

let Service

let Service: string = "kinesis.amazonaws.com";

const KmsPrincipal

let Service

let Service: string = "kms.amazonaws.com";

const LambdaPrincipal

let Service

let Service: string = "lambda.amazonaws.com";

const LightsailPrincipal

let Service

let Service: string = "lightsail.amazonaws.com";

const LogsPrincipal

let Service

let Service: string = "logs.amazonaws.com";

const MonitoringPrincipal

let Service

let Service: string = "monitoring.amazonaws.com";

const OpsworksPrincipal

let Service

let Service: string = "opsworks.amazonaws.com";

const OrganizationsPrincipal

let Service

let Service: string = "organizations.amazonaws.com";

const RdsPrincipal

let Service

let Service: string = "rds.amazonaws.com";

const RedshiftPrincipal

let Service

let Service: string = "redshift.amazonaws.com";

const Route53Principal

let Service

let Service: string = "route53.amazonaws.com";

const S3Principal

let Service

let Service: string = "s3.amazonaws.com";

const ServiceCatalogPrincipal

let Service

let Service: string = "servicecatalog.amazonaws.com";

const SesPrincipal

let Service

let Service: string = "ses.amazonaws.com";

const SigninPrincipal

let Service

let Service: string = "signin.amazonaws.com";

const SnsPrincipal

let Service

let Service: string = "sns.amazonaws.com";

const SpotFleetPrincipal

let Service

let Service: string = "spotfleet.amazonaws.com";

const SqsPrincipal

let Service

let Service: string = "sqs.amazonaws.com";

const SsmPrincipal

let Service

let Service: string = "ssm.amazonaws.com";

const StorageGatewayPrincipal

let Service

let Service: string = "storagegateway.amazonaws.com";

const StsPrincipal

let Service

let Service: string = "sts.amazonaws.com";

const SupportPrincipal

let Service

let Service: string = "support.amazonaws.com";

const VmiePrincipal

let Service

let Service: string = "vmie.amazonaws.com";

const VpcFlowLogsPrincipal

let Service

let Service: string = "vpc-flow-logs.amazonaws.com";

const WafPrincipal

let Service

let Service: string = "waf.amazonaws.com";

const WorkDocsPrincipal

let Service

let Service: string = "workdocs.amazonaws.com";

const WorkspacesPrincipal

let Service

let Service: string = "workspaces.amazonaws.com";

Resources

Resource AccessKey

class AccessKey extends CustomResource

Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const lbUser = new aws.iam.User("lbUser", {path: "/system/"});
const lbAccessKey = new aws.iam.AccessKey("lbAccessKey", {
    user: lbUser.name,
    pgpKey: "keybase:some_person_that_exists",
});
const lbRo = new aws.iam.UserPolicy("lbRo", {
    user: lbUser.name,
    policy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
`,
});
export const secret = lbAccessKey.encryptedSecret;

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const testUser = new aws.iam.User("testUser", {path: "/test/"});
const testAccessKey = new aws.iam.AccessKey("testAccessKey", {user: testUser.name});
export const awsIamSmtpPasswordV4 = testAccessKey.sesSmtpPasswordV4;

constructor

new AccessKey(name: string, args: AccessKeyArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessKey resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessKeyState, opts?: pulumi.CustomResourceOptions): AccessKey

Get an existing AccessKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccessKey

Returns true if the given object is an instance of AccessKey. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property encryptedSecret

public encryptedSecret: pulumi.Output<string>;

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property keyFingerprint

public keyFingerprint: pulumi.Output<string>;

The fingerprint of the PGP key used to encrypt the secret

property pgpKey

public pgpKey: pulumi.Output<string | undefined>;

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists, for use in the encryptedSecret output attribute.

property secret

public secret: pulumi.Output<string>;

The secret access key. Note that this will be written to the state file. If you use this, please protect your backend state file judiciously. Alternatively, you may supply a pgpKey instead, which will prevent the secret from being stored in plaintext, at the cost of preventing the use of the secret key in automation.

property sesSmtpPasswordV4

public sesSmtpPasswordV4: pulumi.Output<string>;

The secret access key converted into an SES SMTP password by applying AWS’s documented Sigv4 conversion algorithm. As SigV4 is region specific, valid Provider regions are ap-south-1, ap-southeast-2, eu-central-1, eu-west-1, us-east-1 and us-west-2. See current AWS SES regions

property status

public status: pulumi.Output<string>;

The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

property user

public user: pulumi.Output<string>;

The IAM user to associate with this access key.

Resource AccountAlias

class AccountAlias extends CustomResource

Note: There is only a single account alias per AWS account.

Manages the account alias for the AWS Account.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const alias = new aws.iam.AccountAlias("alias", {
    accountAlias: "my-account-alias",
});

constructor

new AccountAlias(name: string, args: AccountAliasArgs, opts?: pulumi.CustomResourceOptions)

Create a AccountAlias resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccountAliasState, opts?: pulumi.CustomResourceOptions): AccountAlias

Get an existing AccountAlias resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccountAlias

Returns true if the given object is an instance of AccountAlias. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property accountAlias

public accountAlias: pulumi.Output<string>;

The account alias

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource AccountPasswordPolicy

class AccountPasswordPolicy extends CustomResource

Note: There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.

Manages Password Policy for the AWS Account. See more about Account Password Policy in the official AWS docs.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const strict = new aws.iam.AccountPasswordPolicy("strict", {
    allowUsersToChangePassword: true,
    minimumPasswordLength: 8,
    requireLowercaseCharacters: true,
    requireNumbers: true,
    requireSymbols: true,
    requireUppercaseCharacters: true,
});

constructor

new AccountPasswordPolicy(name: string, args?: AccountPasswordPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a AccountPasswordPolicy resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccountPasswordPolicyState, opts?: pulumi.CustomResourceOptions): AccountPasswordPolicy

Get an existing AccountPasswordPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccountPasswordPolicy

Returns true if the given object is an instance of AccountPasswordPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property allowUsersToChangePassword

public allowUsersToChangePassword: pulumi.Output<boolean | undefined>;

Whether to allow users to change their own password

property expirePasswords

public expirePasswords: pulumi.Output<boolean>;

Indicates whether passwords in the account expire. Returns true if maxPasswordAge contains a value greater than 0. Returns false if it is 0 or not present.

property hardExpiry

public hardExpiry: pulumi.Output<boolean>;

Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property maxPasswordAge

public maxPasswordAge: pulumi.Output<number>;

The number of days that an user password is valid.

property minimumPasswordLength

public minimumPasswordLength: pulumi.Output<number | undefined>;

Minimum length to require for user passwords.

property passwordReusePrevention

public passwordReusePrevention: pulumi.Output<number>;

The number of previous passwords that users are prevented from reusing.

property requireLowercaseCharacters

public requireLowercaseCharacters: pulumi.Output<boolean>;

Whether to require lowercase characters for user passwords.

property requireNumbers

public requireNumbers: pulumi.Output<boolean>;

Whether to require numbers for user passwords.

property requireSymbols

public requireSymbols: pulumi.Output<boolean>;

Whether to require symbols for user passwords.

property requireUppercaseCharacters

public requireUppercaseCharacters: pulumi.Output<boolean>;

Whether to require uppercase characters for user passwords.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource Group

class Group extends CustomResource

Provides an IAM group.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const developers = new aws.iam.Group("developers", {
    path: "/users/",
});

constructor

new Group(name: string, args?: GroupArgs, opts?: pulumi.CustomResourceOptions)

Create a Group resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GroupState, opts?: pulumi.CustomResourceOptions): Group

Get an existing Group resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is Group

Returns true if the given object is an instance of Group. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property arn

public arn: pulumi.Output<string>;

The ARN assigned by AWS for this group.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

property path

public path: pulumi.Output<string | undefined>;

Path in which to create the group.

property uniqueId

public uniqueId: pulumi.Output<string>;

The [unique ID][1] assigned by AWS.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource GroupMembership

class GroupMembership extends CustomResource

WARNING: Multiple aws.iam.GroupMembership resources with the same group name will produce inconsistent behavior!

Provides a top level resource to manage IAM Group membership for IAM Users. For more information on managing IAM Groups or IAM Users, see IAM Groups or IAM Users

Note: aws.iam.GroupMembership will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the [aws.iam.UserGroupMembership resource][3].

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const group = new aws.iam.Group("group", {});
const userOne = new aws.iam.User("userOne", {});
const userTwo = new aws.iam.User("userTwo", {});
const team = new aws.iam.GroupMembership("team", {
    users: [
        userOne.name,
        userTwo.name,
    ],
    group: group.name,
});

constructor

new GroupMembership(name: string, args: GroupMembershipArgs, opts?: pulumi.CustomResourceOptions)

Create a GroupMembership resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GroupMembershipState, opts?: pulumi.CustomResourceOptions): GroupMembership

Get an existing GroupMembership resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is GroupMembership

Returns true if the given object is an instance of GroupMembership. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property group

public group: pulumi.Output<string>;

The IAM Group name to attach the list of users to

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The name to identify the Group Membership

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

property users

public users: pulumi.Output<string[]>;

A list of IAM User names to associate with the Group

Resource GroupPolicy

class GroupPolicy extends CustomResource

Provides an IAM policy attached to a group.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const myDevelopers = new aws.iam.Group("myDevelopers", {path: "/users/"});
const myDeveloperPolicy = new aws.iam.GroupPolicy("myDeveloperPolicy", {
    group: myDevelopers.name,
    policy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
`,
});

constructor

new GroupPolicy(name: string, args: GroupPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a GroupPolicy resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GroupPolicyState, opts?: pulumi.CustomResourceOptions): GroupPolicy

Get an existing GroupPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is GroupPolicy

Returns true if the given object is an instance of GroupPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property group

public group: pulumi.Output<string>;

The IAM group to attach to the policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The name of the policy. If omitted, this provider will assign a random, unique name.

property namePrefix

public namePrefix: pulumi.Output<string | undefined>;

Creates a unique name beginning with the specified prefix. Conflicts with name.

property policy

public policy: pulumi.Output<string>;

The policy document. This is a JSON formatted string.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource GroupPolicyAttachment

class GroupPolicyAttachment extends CustomResource

Attaches a Managed IAM Policy to an IAM group

NOTE: The usage of this resource conflicts with the aws.iam.PolicyAttachment resource and will permanently show a difference if both are defined.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const group = new aws.iam.Group("group", {});
const policy = new aws.iam.Policy("policy", {
    description: "A test policy",
    policy: "{ ... policy JSON ... }",
});
const test_attach = new aws.iam.GroupPolicyAttachment("test-attach", {
    group: group.name,
    policyArn: policy.arn,
});

constructor

new GroupPolicyAttachment(name: string, args: GroupPolicyAttachmentArgs, opts?: pulumi.CustomResourceOptions)

Create a GroupPolicyAttachment resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GroupPolicyAttachmentState, opts?: pulumi.CustomResourceOptions): GroupPolicyAttachment

Get an existing GroupPolicyAttachment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is GroupPolicyAttachment

Returns true if the given object is an instance of GroupPolicyAttachment. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property group

public group: pulumi.Output<string>;

The group the policy should be applied to

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property policyArn

public policyArn: pulumi.Output<ARN>;

The ARN of the policy you want to apply

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource InstanceProfile

class InstanceProfile extends CustomResource

Provides an IAM instance profile.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const role = new aws.iam.Role("role", {
    path: "/",
    assumeRolePolicy: `{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Principal": {
               "Service": "ec2.amazonaws.com"
            },
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
`,
});
const testProfile = new aws.iam.InstanceProfile("testProfile", {role: role.name});

constructor

new InstanceProfile(name: string, args?: InstanceProfileArgs, opts?: pulumi.CustomResourceOptions)

Create a InstanceProfile resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: InstanceProfileState, opts?: pulumi.CustomResourceOptions): InstanceProfile

Get an existing InstanceProfile resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is InstanceProfile

Returns true if the given object is an instance of InstanceProfile. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property arn

public arn: pulumi.Output<string>;

The ARN assigned by AWS to the instance profile.

property createDate

public createDate: pulumi.Output<string>;

The creation timestamp of the instance profile.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The profile’s name. If omitted, this provider will assign a random, unique name.

property namePrefix

public namePrefix: pulumi.Output<string | undefined>;

Creates a unique name beginning with the specified prefix. Conflicts with name.

property path

public path: pulumi.Output<string | undefined>;

Path in which to create the profile.

property role

public role: pulumi.Output<string | undefined>;

The role name to include in the profile.

property uniqueId

public uniqueId: pulumi.Output<string>;

The [unique ID][1] assigned by AWS.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource OpenIdConnectProvider

class OpenIdConnectProvider extends CustomResource

Provides an IAM OpenID Connect provider.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const defaultOpenIdConnectProvider = new aws.iam.OpenIdConnectProvider("default", {
    clientIdLists: ["266362248691-342342xasdasdasda-apps.googleusercontent.com"],
    thumbprintLists: [],
    url: "https://accounts.google.com",
});

constructor

new OpenIdConnectProvider(name: string, args: OpenIdConnectProviderArgs, opts?: pulumi.CustomResourceOptions)

Create a OpenIdConnectProvider resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: OpenIdConnectProviderState, opts?: pulumi.CustomResourceOptions): OpenIdConnectProvider

Get an existing OpenIdConnectProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is OpenIdConnectProvider

Returns true if the given object is an instance of OpenIdConnectProvider. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property arn

public arn: pulumi.Output<string>;

The ARN assigned by AWS for this provider.

property clientIdLists

public clientIdLists: pulumi.Output<string[]>;

A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the clientId parameter on OAuth requests.)

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property thumbprintLists

public thumbprintLists: pulumi.Output<string[]>;

A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

property url

public url: pulumi.Output<string>;

The URL of the identity provider. Corresponds to the iss claim.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource Policy

class Policy extends CustomResource

Provides an IAM policy.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const policy = new aws.iam.Policy("policy", {
    description: "My test policy",
    path: "/",
    policy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
`,
});

constructor

new Policy(name: string, args: PolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a Policy resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyState, opts?: pulumi.CustomResourceOptions): Policy

Get an existing Policy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is Policy

Returns true if the given object is an instance of Policy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property arn

public arn: pulumi.Output<string>;

The ARN assigned by AWS to this policy.

property description

public description: pulumi.Output<string | undefined>;

Description of the IAM policy.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The name of the policy. If omitted, this provider will assign a random, unique name.

property namePrefix

public namePrefix: pulumi.Output<string | undefined>;

Creates a unique name beginning with the specified prefix. Conflicts with name.

property path

public path: pulumi.Output<string | undefined>;

Path in which to create the policy. See IAM Identifiers for more information.

property policy

public policy: pulumi.Output<string>;

The policy document. This is a JSON formatted string.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource PolicyAttachment

class PolicyAttachment extends CustomResource

Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)

!> WARNING: The aws.iam.PolicyAttachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws.iam.PolicyAttachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other resources managed by this provider) will have that attached policy revoked by this resource. Consider aws.iam.RolePolicyAttachment, aws.iam.UserPolicyAttachment, or aws.iam.GroupPolicyAttachment instead. These resources do not enforce exclusive attachment of an IAM policy.

NOTE: The usage of this resource conflicts with the aws.iam.GroupPolicyAttachment, aws.iam.RolePolicyAttachment, and aws.iam.UserPolicyAttachment resources and will permanently show a difference if both are defined.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const user = new aws.iam.User("user", {});
const role = new aws.iam.Role("role", {assumeRolePolicy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
`});
const group = new aws.iam.Group("group", {});
const policy = new aws.iam.Policy("policy", {
    description: "A test policy",
    policy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
`,
});
const test_attach = new aws.iam.PolicyAttachment("test-attach", {
    users: [user.name],
    roles: [role.name],
    groups: [group.name],
    policyArn: policy.arn,
});

constructor

new PolicyAttachment(name: string, args: PolicyAttachmentArgs, opts?: pulumi.CustomResourceOptions)

Create a PolicyAttachment resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PolicyAttachmentState, opts?: pulumi.CustomResourceOptions): PolicyAttachment

Get an existing PolicyAttachment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is PolicyAttachment

Returns true if the given object is an instance of PolicyAttachment. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property groups

public groups: pulumi.Output<string[] | undefined>;

The group(s) the policy should be applied to

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

The name of the attachment. This cannot be an empty string.

property policyArn

public policyArn: pulumi.Output<ARN>;

The ARN of the policy you want to apply

property roles

public roles: pulumi.Output<string[] | undefined>;

The role(s) the policy should be applied to

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

property users

public users: pulumi.Output<string[] | undefined>;

The user(s) the policy should be applied to

Resource Role

class Role extends CustomResource

Provides an IAM role.

NOTE: If policies are attached to the role via the aws.iam.PolicyAttachment resource and you are modifying the role name or path, the forceDetachPolicies argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The aws.iam.RolePolicyAttachment resource (recommended) does not have this requirement.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const testRole = new aws.iam.Role("test_role", {
    assumeRolePolicy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
`,
    tags: {
        "tag-key": "tag-value",
    },
});

Example of Using Data Source for Assume Role Policy

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const instance-assume-role-policy = aws.iam.getPolicyDocument({
    statements: [{
        actions: ["sts:AssumeRole"],
        principals: [{
            type: "Service",
            identifiers: ["ec2.amazonaws.com"],
        }],
    }],
});
const instance = new aws.iam.Role("instance", {
    path: "/system/",
    assumeRolePolicy: instance_assume_role_policy.then(instance_assume_role_policy => instance_assume_role_policy.json),
});

constructor

new Role(name: string, args: RoleArgs, opts?: pulumi.CustomResourceOptions)

Create a Role resource with the given unique name, arguments, and options.

• name The unique name of the resource.
• args The arguments to use to populate this resource's properties.
• opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: RoleState, opts?: pulumi.CustomResourceOptions): Role

Get an existing Role resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider