iam

This provider is a derived work of the Terraform Provider distributed under MPL 2.0. If you encounter a bug or missing feature, first check the pulumi/pulumi-aws repo; however, if that doesn’t turn up anything, please consult the source terraform-providers/terraform-provider-aws repo.

class pulumi_aws.iam.AccessKey(resource_name, opts=None, pgp_key=None, status=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.

  • status (pulumi.Input[str]) – The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

  • user (pulumi.Input[str]) – The IAM user to associate with this access key.

encrypted_secret = None

The encrypted secret, base64 encoded.

NOTE: The encrypted secret may be decrypted using the command line, for example: ... | base64 --decode | keybase pgp decrypt.

key_fingerprint = None

The fingerprint of the PGP key used to encrypt the secret

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.

secret = None

The secret access key. Note that this will be written to the state file. Please supply a pgp_key instead, which will prevent the secret from being stored in plain text

ses_smtp_password = None

The secret access key converted into an SES SMTP password by applying AWS’s documented conversion algorithm.

status = None

The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

user = None

The IAM user to associate with this access key.

static get(resource_name, id, opts=None, encrypted_secret=None, key_fingerprint=None, pgp_key=None, secret=None, ses_smtp_password=None, status=None, user=None)

Get an existing AccessKey resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • encrypted_secret (pulumi.Input[str]) – The encrypted secret, base64 encoded.

> **NOTE:** The encrypted secret may be decrypted using the command line,
for example: `... | base64 --decode | keybase pgp decrypt`.
Parameters
  • key_fingerprint (pulumi.Input[str]) – The fingerprint of the PGP key used to encrypt the secret

  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.

  • secret (pulumi.Input[str]) – The secret access key. Note that this will be written to the state file. Please supply a pgp_key instead, which will prevent the secret from being stored in plain text

  • ses_smtp_password (pulumi.Input[str]) –

    The secret access key converted into an SES SMTP password by applying AWS’s documented conversion algorithm.

  • status (pulumi.Input[str]) – The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

  • user (pulumi.Input[str]) – The IAM user to associate with this access key.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.AccountAlias(resource_name, opts=None, account_alias=None, __props__=None, __name__=None, __opts__=None)

Note: There is only a single account alias per AWS account.

Manages the account alias for the AWS Account.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • account_alias (pulumi.Input[str]) – The account alias

account_alias = None

The account alias

static get(resource_name, id, opts=None, account_alias=None)

Get an existing AccountAlias resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • account_alias (pulumi.Input[str]) – The account alias

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.AccountPasswordPolicy(resource_name, opts=None, allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, __props__=None, __name__=None, __opts__=None)

Note: There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.

Manages Password Policy for the AWS Account. See more about Account Password Policy in the official AWS docs.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • allow_users_to_change_password (pulumi.Input[bool]) – Whether to allow users to change their own password

  • hard_expiry (pulumi.Input[bool]) – Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

  • max_password_age (pulumi.Input[float]) – The number of days that an user password is valid.

  • minimum_password_length (pulumi.Input[float]) – Minimum length to require for user passwords.

  • password_reuse_prevention (pulumi.Input[float]) – The number of previous passwords that users are prevented from reusing.

  • require_lowercase_characters (pulumi.Input[bool]) – Whether to require lowercase characters for user passwords.

  • require_numbers (pulumi.Input[bool]) – Whether to require numbers for user passwords.

  • require_symbols (pulumi.Input[bool]) – Whether to require symbols for user passwords.

  • require_uppercase_characters (pulumi.Input[bool]) – Whether to require uppercase characters for user passwords.

allow_users_to_change_password = None

Whether to allow users to change their own password

expire_passwords = None

Indicates whether passwords in the account expire. Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present.

hard_expiry = None

Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

max_password_age = None

The number of days that an user password is valid.

minimum_password_length = None

Minimum length to require for user passwords.

password_reuse_prevention = None

The number of previous passwords that users are prevented from reusing.

require_lowercase_characters = None

Whether to require lowercase characters for user passwords.

require_numbers = None

Whether to require numbers for user passwords.

require_symbols = None

Whether to require symbols for user passwords.

require_uppercase_characters = None

Whether to require uppercase characters for user passwords.

static get(resource_name, id, opts=None, allow_users_to_change_password=None, expire_passwords=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None)

Get an existing AccountPasswordPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • allow_users_to_change_password (pulumi.Input[bool]) – Whether to allow users to change their own password

  • expire_passwords (pulumi.Input[bool]) – Indicates whether passwords in the account expire. Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present.

  • hard_expiry (pulumi.Input[bool]) – Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

  • max_password_age (pulumi.Input[float]) – The number of days that an user password is valid.

  • minimum_password_length (pulumi.Input[float]) – Minimum length to require for user passwords.

  • password_reuse_prevention (pulumi.Input[float]) – The number of previous passwords that users are prevented from reusing.

  • require_lowercase_characters (pulumi.Input[bool]) – Whether to require lowercase characters for user passwords.

  • require_numbers (pulumi.Input[bool]) – Whether to require numbers for user passwords.

  • require_symbols (pulumi.Input[bool]) – Whether to require symbols for user passwords.

  • require_uppercase_characters (pulumi.Input[bool]) – Whether to require uppercase characters for user passwords.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.AwaitableGetAccountAliasResult(account_alias=None, id=None)
class pulumi_aws.iam.AwaitableGetGroupResult(arn=None, group_id=None, group_name=None, path=None, id=None)
class pulumi_aws.iam.AwaitableGetInstanceProfileResult(arn=None, create_date=None, name=None, path=None, role_arn=None, role_id=None, role_name=None, id=None)
class pulumi_aws.iam.AwaitableGetPolicyDocumentResult(json=None, override_json=None, policy_id=None, source_json=None, statements=None, version=None, id=None)
class pulumi_aws.iam.AwaitableGetPolicyResult(arn=None, description=None, name=None, path=None, policy=None, id=None)
class pulumi_aws.iam.AwaitableGetRoleResult(arn=None, assume_role_policy=None, create_date=None, description=None, max_session_duration=None, name=None, path=None, permissions_boundary=None, unique_id=None, id=None)
class pulumi_aws.iam.AwaitableGetServerCertificateResult(arn=None, certificate_body=None, certificate_chain=None, expiration_date=None, latest=None, name=None, name_prefix=None, path=None, path_prefix=None, upload_date=None, id=None)
class pulumi_aws.iam.AwaitableGetUserResult(arn=None, path=None, permissions_boundary=None, user_id=None, user_name=None, id=None)
class pulumi_aws.iam.GetAccountAliasResult(account_alias=None, id=None)

A collection of values returned by getAccountAlias.

account_alias = None

The alias associated with the AWS account.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetGroupResult(arn=None, group_id=None, group_name=None, path=None, id=None)

A collection of values returned by getGroup.

arn = None

The Amazon Resource Name (ARN) specifying the group.

group_id = None

The stable and unique string identifying the group.

path = None

The path to the group.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetInstanceProfileResult(arn=None, create_date=None, name=None, path=None, role_arn=None, role_id=None, role_name=None, id=None)

A collection of values returned by getInstanceProfile.

arn = None

The Amazon Resource Name (ARN) specifying the instance profile.

create_date = None

The string representation of the date the instance profile was created.

path = None

The path to the instance profile.

role_arn = None

The role arn associated with this instance profile.

role_id = None

The role id associated with this instance profile.

role_name = None

The role name associated with this instance profile.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyDocumentResult(json=None, override_json=None, policy_id=None, source_json=None, statements=None, version=None, id=None)

A collection of values returned by getPolicyDocument.

json = None

The above arguments serialized as a standard JSON policy document.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyResult(arn=None, description=None, name=None, path=None, policy=None, id=None)

A collection of values returned by getPolicy.

arn = None

The Amazon Resource Name (ARN) specifying the policy.

description = None

The description of the policy.

name = None

The name of the IAM policy.

path = None

The path to the policy.

policy = None

The policy document of the policy.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetRoleResult(arn=None, assume_role_policy=None, create_date=None, description=None, max_session_duration=None, name=None, path=None, permissions_boundary=None, unique_id=None, id=None)

A collection of values returned by getRole.

arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy document associated with the role.

create_date = None

Creation date of the role in RFC 3339 format.

description = None

Description for the role.

max_session_duration = None

Maximum session duration.

path = None

The path to the role.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

unique_id = None

The stable and unique string identifying the role.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetServerCertificateResult(arn=None, certificate_body=None, certificate_chain=None, expiration_date=None, latest=None, name=None, name_prefix=None, path=None, path_prefix=None, upload_date=None, id=None)

A collection of values returned by getServerCertificate.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetUserResult(arn=None, path=None, permissions_boundary=None, user_id=None, user_name=None, id=None)

A collection of values returned by getUser.

arn = None

The Amazon Resource Name (ARN) assigned by AWS for this user.

path = None

Path in which this user was created.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

user_id = None

The unique ID assigned by AWS for this user.

user_name = None

The name associated to this User

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.Group(resource_name, opts=None, name=None, path=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM group.

Parameters
  • resource*name (str) –

    The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-*.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

  • path (pulumi.Input[str]) – Path in which to create the group.

arn = None

The ARN assigned by AWS for this group.

name = None

The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

path = None

Path in which to create the group.

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, name=None, path=None, unique_id=None)

Get an existing Group resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource*name (str) –

    The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS for this group.

  • name (pulumi.Input[str]) – The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-*.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

  • path (pulumi.Input[str]) – Path in which to create the group.

  • unique_id (pulumi.Input[str]) – The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.GroupMembership(resource_name, opts=None, group=None, name=None, users=None, __props__=None, __name__=None, __opts__=None)

WARNING: Multiple iam.GroupMembership resources with the same group name will produce inconsistent behavior!

Provides a top level resource to manage IAM Group membership for IAM Users. For more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or [IAM Users][2]

Note: iam.GroupMembership will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the [iam.UserGroupMembership resource][3].

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The IAM Group name to attach the list of users to

  • name (pulumi.Input[str]) – The name to identify the Group Membership

  • users (pulumi.Input[list]) – A list of IAM User names to associate with the Group

group = None

The IAM Group name to attach the list of users to

name = None

The name to identify the Group Membership

users = None

A list of IAM User names to associate with the Group

static get(resource_name, id, opts=None, group=None, name=None, users=None)

Get an existing GroupMembership resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The IAM Group name to attach the list of users to

  • name (pulumi.Input[str]) – The name to identify the Group Membership

  • users (pulumi.Input[list]) – A list of IAM User names to associate with the Group

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.GroupPolicy(resource_name, opts=None, group=None, name=None, name_prefix=None, policy=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a group.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The IAM group to attach to the policy.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

group = None

The IAM group to attach to the policy.

name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

static get(resource_name, id, opts=None, group=None, name=None, name_prefix=None, policy=None)

Get an existing GroupPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The IAM group to attach to the policy.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.GroupPolicyAttachment(resource_name, opts=None, group=None, policy_arn=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM group

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The group the policy should be applied to

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

group = None

The group the policy should be applied to

policy_arn = None

The ARN of the policy you want to apply

static get(resource_name, id, opts=None, group=None, policy_arn=None)

Get an existing GroupPolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • group (pulumi.Input[str]) – The group the policy should be applied to

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.InstanceProfile(resource_name, opts=None, name=None, name_prefix=None, path=None, role=None, roles=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM instance profile.

NOTE: Either role or roles (deprecated) must be specified.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The profile’s name. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) – Path in which to create the profile.

  • role (pulumi.Input[str]) – The role name to include in the profile.

  • roles (pulumi.Input[list]) – A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.

arn = None

The ARN assigned by AWS to the instance profile.

create_date = None

The creation timestamp of the instance profile.

name = None

The profile’s name. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the profile.

role = None

The role name to include in the profile.

roles = None

A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, create_date=None, name=None, name_prefix=None, path=None, role=None, roles=None, unique_id=None)

Get an existing InstanceProfile resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS to the instance profile.

  • create_date (pulumi.Input[str]) – The creation timestamp of the instance profile.

  • name (pulumi.Input[str]) – The profile’s name. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) – Path in which to create the profile.

  • role (pulumi.Input[str]) – The role name to include in the profile.

  • roles (pulumi.Input[list]) – A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.

  • unique_id (pulumi.Input[str]) – The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.OpenIdConnectProvider(resource_name, opts=None, client_id_lists=None, thumbprint_lists=None, url=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM OpenID Connect provider.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • client_id_lists (pulumi.Input[list]) – A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)

  • thumbprint_lists (pulumi.Input[list]) – A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

  • url (pulumi.Input[str]) – The URL of the identity provider. Corresponds to the iss claim.

arn = None

The ARN assigned by AWS for this provider.

client_id_lists = None

A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)

thumbprint_lists = None

A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

url = None

The URL of the identity provider. Corresponds to the iss claim.

static get(resource_name, id, opts=None, arn=None, client_id_lists=None, thumbprint_lists=None, url=None)

Get an existing OpenIdConnectProvider resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS for this provider.

  • client_id_lists (pulumi.Input[list]) – A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)

  • thumbprint_lists (pulumi.Input[list]) – A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

  • url (pulumi.Input[str]) – The URL of the identity provider. Corresponds to the iss claim.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.Policy(resource_name, opts=None, description=None, name=None, name_prefix=None, path=None, policy=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • description (pulumi.Input[str]) – Description of the IAM policy.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) – Path in which to create the policy. See IAM Identifiers for more information.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

arn = None

The ARN assigned by AWS to this policy.

description = None

Description of the IAM policy.

name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the policy. See IAM Identifiers for more information.

policy = None

The policy document. This is a JSON formatted string.

static get(resource_name, id, opts=None, arn=None, description=None, name=None, name_prefix=None, path=None, policy=None)

Get an existing Policy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS to this policy.

  • description (pulumi.Input[str]) – Description of the IAM policy.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) –

    Path in which to create the policy. See IAM Identifiers for more information.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.PolicyAttachment(resource_name, opts=None, groups=None, name=None, policy_arn=None, roles=None, users=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)

!> WARNING: The iam.PolicyAttachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single iam.PolicyAttachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other resources managed by this provider) will have that attached policy revoked by this resource. Consider iam.RolePolicyAttachment, iam.UserPolicyAttachment, or iam.GroupPolicyAttachment instead. These resources do not enforce exclusive attachment of an IAM policy.

NOTE: The usage of this resource conflicts with the iam.GroupPolicyAttachment, iam.RolePolicyAttachment, and iam.UserPolicyAttachment resources and will permanently show a difference if both are defined.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • groups (pulumi.Input[list]) – The group(s) the policy should be applied to

  • name (pulumi.Input[str]) – The name of the attachment. This cannot be an empty string.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • roles (pulumi.Input[list]) – The role(s) the policy should be applied to

  • users (pulumi.Input[list]) – The user(s) the policy should be applied to

groups = None

The group(s) the policy should be applied to

name = None

The name of the attachment. This cannot be an empty string.

policy_arn = None

The ARN of the policy you want to apply

roles = None

The role(s) the policy should be applied to

users = None

The user(s) the policy should be applied to

static get(resource_name, id, opts=None, groups=None, name=None, policy_arn=None, roles=None, users=None)

Get an existing PolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • groups (pulumi.Input[list]) – The group(s) the policy should be applied to

  • name (pulumi.Input[str]) – The name of the attachment. This cannot be an empty string.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • roles (pulumi.Input[list]) – The role(s) the policy should be applied to

  • users (pulumi.Input[list]) – The user(s) the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.Role(resource_name, opts=None, assume_role_policy=None, description=None, force_detach_policies=None, max_session_duration=None, name=None, name_prefix=None, path=None, permissions_boundary=None, tags=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM role.

NOTE: If policies are attached to the role via the ``iam.PolicyAttachment` resource <https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html>`_ and you are modifying the role name or path, the force_detach_policies argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The ``iam.RolePolicyAttachment` resource (recommended) <https://www.terraform.io/docs/providers/aws/r/iam_role_policy_attachment.html>`_ does not have this requirement.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • assume_role_policy (pulumi.Input[str]) – The policy that grants an entity permission to assume the role.

  • description (pulumi.Input[str]) – The description of the role.

  • force_detach_policies (pulumi.Input[bool]) – Specifies to force detaching any policies the role has before destroying it. Defaults to false.

  • max_session_duration (pulumi.Input[float]) – The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

  • name (pulumi.Input[str]) – The name of the role. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) –

    The path to the role. See IAM Identifiers for more information.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the role.

  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM role

arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy that grants an entity permission to assume the role.

create_date = None

The creation date of the IAM role.

description = None

The description of the role.

force_detach_policies = None

Specifies to force detaching any policies the role has before destroying it. Defaults to false.

max_session_duration = None

The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

name = None

The name of the role. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The path to the role. See IAM Identifiers for more information.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

tags = None

Key-value mapping of tags for the IAM role

unique_id = None

The stable and unique string identifying the role.

static get(resource_name, id, opts=None, arn=None, assume_role_policy=None, create_date=None, description=None, force_detach_policies=None, max_session_duration=None, name=None, name_prefix=None, path=None, permissions_boundary=None, tags=None, unique_id=None)

Get an existing Role resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the role.

  • assume_role_policy (pulumi.Input[str]) – The policy that grants an entity permission to assume the role.

  • create_date (pulumi.Input[str]) – The creation date of the IAM role.

  • description (pulumi.Input[str]) – The description of the role.

  • force_detach_policies (pulumi.Input[bool]) – Specifies to force detaching any policies the role has before destroying it. Defaults to false.

  • max_session_duration (pulumi.Input[float]) – The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

  • name (pulumi.Input[str]) – The name of the role. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) –

    The path to the role. See IAM Identifiers for more information.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the role.

  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM role

  • unique_id (pulumi.Input[str]) – The stable and unique string identifying the role.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.RolePolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, role=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM role policy.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The name of the role policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

  • role (pulumi.Input[str]) – The IAM role to attach to the policy.

name = None

The name of the role policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

role = None

The IAM role to attach to the policy.

static get(resource_name, id, opts=None, name=None, name_prefix=None, policy=None, role=None)

Get an existing RolePolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The name of the role policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

  • role (pulumi.Input[str]) – The IAM role to attach to the policy.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.RolePolicyAttachment(resource_name, opts=None, policy_arn=None, role=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM role

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • role (pulumi.Input[str]) – The role the policy should be applied to

policy_arn = None

The ARN of the policy you want to apply

role = None

The role the policy should be applied to

static get(resource_name, id, opts=None, policy_arn=None, role=None)

Get an existing RolePolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • role (pulumi.Input[str]) – The role the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.SamlProvider(resource_name, opts=None, name=None, saml_metadata_document=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM SAML provider.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The name of the provider to create.

  • saml_metadata_document (pulumi.Input[str]) – An XML document generated by an identity provider that supports SAML 2.0.

arn = None

The ARN assigned by AWS for this provider.

name = None

The name of the provider to create.

saml_metadata_document = None

An XML document generated by an identity provider that supports SAML 2.0.

valid_until = None

The expiration date and time for the SAML provider in RFC1123 format, e.g. Mon, 02 Jan 2006 15:04:05 MST.

static get(resource_name, id, opts=None, arn=None, name=None, saml_metadata_document=None, valid_until=None)

Get an existing SamlProvider resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS for this provider.

  • name (pulumi.Input[str]) – The name of the provider to create.

  • saml_metadata_document (pulumi.Input[str]) – An XML document generated by an identity provider that supports SAML 2.0.

  • valid_until (pulumi.Input[str]) – The expiration date and time for the SAML provider in RFC1123 format, e.g. Mon, 02 Jan 2006 15:04:05 MST.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.ServerCertificate(resource_name, opts=None, arn=None, certificate_body=None, certificate_chain=None, name=None, name_prefix=None, path=None, private_key=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM Server Certificate resource to upload Server Certificates. Certs uploaded to IAM can easily work with other AWS services such as:

  • AWS Elastic Beanstalk

  • Elastic Load Balancing

  • CloudFront

  • AWS OpsWorks

For information about server certificates in IAM, see [Managing Server Certificates][2] in AWS Documentation.

Note: All arguments including the private key will be stored in the raw state as plain-text. Read more about sensitive data in state.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the server certificate.

  • certificate_body (pulumi.Input[str]) – The contents of the public key certificate in PEM-encoded format.

  • certificate_chain (pulumi.Input[str]) – The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

  • name (pulumi.Input[str]) – The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) – The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.

  • private_key (pulumi.Input[str]) – The contents of the private key in PEM-encoded format.

arn = None

The Amazon Resource Name (ARN) specifying the server certificate.

certificate_body = None

The contents of the public key certificate in PEM-encoded format.

certificate_chain = None

The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

name = None

The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.

private_key = None

The contents of the private key in PEM-encoded format.

static get(resource_name, id, opts=None, arn=None, certificate_body=None, certificate_chain=None, name=None, name_prefix=None, path=None, private_key=None)

Get an existing ServerCertificate resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the server certificate.

  • certificate_body (pulumi.Input[str]) – The contents of the public key certificate in PEM-encoded format.

  • certificate_chain (pulumi.Input[str]) – The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

  • name (pulumi.Input[str]) – The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • path (pulumi.Input[str]) – The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.

  • private_key (pulumi.Input[str]) – The contents of the private key in PEM-encoded format.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.ServiceLinkedRole(resource_name, opts=None, aws_service_name=None, custom_suffix=None, description=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM service-linked role.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • aws_service_name (pulumi.Input[str]) – The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.

  • custom_suffix (pulumi.Input[str]) – Additional string appended to the role name. Not all AWS services support custom suffixes.

  • description (pulumi.Input[str]) – The description of the role.

arn = None

The Amazon Resource Name (ARN) specifying the role.

aws_service_name = None

The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.

create_date = None

The creation date of the IAM role.

custom_suffix = None

Additional string appended to the role name. Not all AWS services support custom suffixes.

description = None

The description of the role.

name = None

The name of the role.

path = None

The path of the role.

unique_id = None

The stable and unique string identifying the role.

static get(resource_name, id, opts=None, arn=None, aws_service_name=None, create_date=None, custom_suffix=None, description=None, name=None, path=None, unique_id=None)

Get an existing ServiceLinkedRole resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the role.

  • aws_service_name (pulumi.Input[str]) –

    The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.

  • create_date (pulumi.Input[str]) – The creation date of the IAM role.

  • custom_suffix (pulumi.Input[str]) – Additional string appended to the role name. Not all AWS services support custom suffixes.

  • description (pulumi.Input[str]) – The description of the role.

  • name (pulumi.Input[str]) – The name of the role.

  • path (pulumi.Input[str]) – The path of the role.

  • unique_id (pulumi.Input[str]) – The stable and unique string identifying the role.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.SshKey(resource_name, opts=None, encoding=None, public_key=None, status=None, username=None, __props__=None, __name__=None, __opts__=None)

Uploads an SSH public key and associates it with the specified IAM user.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • encoding (pulumi.Input[str]) – Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.

  • public_key (pulumi.Input[str]) – The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.

  • status (pulumi.Input[str]) – The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.

  • username (pulumi.Input[str]) – The name of the IAM user to associate the SSH public key with.

encoding = None

Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.

fingerprint = None

The MD5 message digest of the SSH public key.

public_key = None

The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.

ssh_public_key_id = None

The unique identifier for the SSH public key.

status = None

The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.

username = None

The name of the IAM user to associate the SSH public key with.

static get(resource_name, id, opts=None, encoding=None, fingerprint=None, public_key=None, ssh_public_key_id=None, status=None, username=None)

Get an existing SshKey resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • encoding (pulumi.Input[str]) – Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.

  • fingerprint (pulumi.Input[str]) – The MD5 message digest of the SSH public key.

  • public_key (pulumi.Input[str]) – The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.

  • ssh_public_key_id (pulumi.Input[str]) – The unique identifier for the SSH public key.

  • status (pulumi.Input[str]) – The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.

  • username (pulumi.Input[str]) – The name of the IAM user to associate the SSH public key with.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.User(resource_name, opts=None, force_destroy=None, name=None, path=None, permissions_boundary=None, tags=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM user.

NOTE: If policies are attached to the user via the ``iam.PolicyAttachment` resource <https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html>`_ and you are modifying the user name or path, the force_destroy argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The ``iam.UserPolicyAttachment` resource (recommended) <https://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html>`_ does not have this requirement.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • force_destroy (pulumi.Input[bool]) – When destroying this user, destroy even if it has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.

  • name (pulumi.Input[str]) – The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.

  • path (pulumi.Input[str]) – Path in which to create the user.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the user.

  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM user

arn = None

The ARN assigned by AWS for this user.

force_destroy = None

When destroying this user, destroy even if it has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.

name = None

The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.

path = None

Path in which to create the user.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

tags = None

Key-value mapping of tags for the IAM user

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, force_destroy=None, name=None, path=None, permissions_boundary=None, tags=None, unique_id=None)

Get an existing User resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • arn (pulumi.Input[str]) – The ARN assigned by AWS for this user.

  • force_destroy (pulumi.Input[bool]) – When destroying this user, destroy even if it has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.

  • name (pulumi.Input[str]) – The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.

  • path (pulumi.Input[str]) – Path in which to create the user.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the user.

  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM user

  • unique_id (pulumi.Input[str]) – The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.UserGroupMembership(resource_name, opts=None, groups=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides a resource for adding an [IAM User][2] to [IAM Groups][1]. This resource can be used multiple times with the same user for non-overlapping groups.

To exclusively manage the users in a group, see the [iam.GroupMembership resource][3].

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • groups (pulumi.Input[list]) – A list of [IAM Groups][1] to add the user to

  • user (pulumi.Input[str]) – The name of the [IAM User][2] to add to groups

groups = None

A list of [IAM Groups][1] to add the user to

user = None

The name of the [IAM User][2] to add to groups

static get(resource_name, id, opts=None, groups=None, user=None)

Get an existing UserGroupMembership resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • groups (pulumi.Input[list]) – A list of [IAM Groups][1] to add the user to

  • user (pulumi.Input[str]) – The name of the [IAM User][2] to add to groups

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.UserLoginProfile(resource_name, opts=None, password_length=None, password_reset_required=None, pgp_key=None, user=None, __props__=None, __name__=None, __opts__=None)

Manages an IAM User Login Profile with limited support for password creation during this provider resource creation. Uses PGP to encrypt the password for safe transport to the user. PGP keys can be obtained from Keybase.

To reset an IAM User login password via this provider, you can use delete and recreate this resource or change any of the arguments.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • password_length (pulumi.Input[float]) – The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

  • password_reset_required (pulumi.Input[bool]) – Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.

  • user (pulumi.Input[str]) – The IAM user’s name.

encrypted_password = None

The encrypted password, base64 encoded. Only available if password was handled on this provider resource creation, not import.

key_fingerprint = None

The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on this provider resource creation, not import.

password_length = None

The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

password_reset_required = None

Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.

user = None

The IAM user’s name.

static get(resource_name, id, opts=None, encrypted_password=None, key_fingerprint=None, password_length=None, password_reset_required=None, pgp_key=None, user=None)

Get an existing UserLoginProfile resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • encrypted_password (pulumi.Input[str]) – The encrypted password, base64 encoded. Only available if password was handled on this provider resource creation, not import.

  • key_fingerprint (pulumi.Input[str]) – The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on this provider resource creation, not import.

  • password_length (pulumi.Input[float]) – The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

  • password_reset_required (pulumi.Input[bool]) – Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.

  • user (pulumi.Input[str]) – The IAM user’s name.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.UserPolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a user.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

  • user (pulumi.Input[str]) – IAM user to which to attach this policy.

name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

user = None

IAM user to which to attach this policy.

static get(resource_name, id, opts=None, name=None, name_prefix=None, policy=None, user=None)

Get an existing UserPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.

  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.

  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.

  • user (pulumi.Input[str]) – IAM user to which to attach this policy.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

class pulumi_aws.iam.UserPolicyAttachment(resource_name, opts=None, policy_arn=None, user=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM user

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.

Parameters
  • resource_name (str) – The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • user (pulumi.Input[str]) – The user the policy should be applied to

policy_arn = None

The ARN of the policy you want to apply

user = None

The user the policy should be applied to

static get(resource_name, id, opts=None, policy_arn=None, user=None)

Get an existing UserPolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters
  • resource_name (str) – The unique name of the resulting resource.

  • id (str) – The unique provider ID of the resource to lookup.

  • opts (pulumi.ResourceOptions) – Options for the resource.

  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply

  • user (pulumi.Input[str]) – The user the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters

prop (str) – A property name.

Returns

A potentially transformed property name.

Return type

str

pulumi_aws.iam.get_account_alias(opts=None)

The IAM Account Alias data source allows access to the account alias for the effective account in which this provider is working.

pulumi_aws.iam.get_group(group_name=None, opts=None)

This data source can be used to fetch information about a specific IAM group. By using this data source, you can reference IAM group properties without having to hard code ARNs as input.

Parameters

group_name (str) – The friendly IAM group name to match.

pulumi_aws.iam.get_instance_profile(name=None, opts=None)

This data source can be used to fetch information about a specific IAM instance profile. By using this data source, you can reference IAM instance profile properties without having to hard code ARNs as input.

Parameters

name (str) – The friendly IAM instance profile name to match.

pulumi_aws.iam.get_policy(arn=None, opts=None)

This data source can be used to fetch information about a specific IAM policy.

Parameters

arn (str) – ARN of the IAM policy.

pulumi_aws.iam.get_policy_document(override_json=None, policy_id=None, source_json=None, statements=None, version=None, opts=None)

Generates an IAM policy document in JSON format.

This is a data source which can be used to construct a JSON representation of an IAM policy document, for use with resources which expect policy documents, such as the iam.Policy resource.

Using this data source to generate policy documents is optional. It is also valid to use literal JSON strings within your configuration, or to use the file interpolation function to read a raw JSON policy document from a file.

The IAM policy document format allows context variables to be interpolated into various strings within a statement. The native IAM policy document format uses ${...}-style syntax that is in conflict with interpolation syntax, so this data source instead uses &{...} syntax for interpolations that should be processed by AWS rather than by this provider.

In order to define wildcard principal (a.k.a. anonymous user) use type = "*" and identifiers = ["*"]. In that case the rendered json will contain "Principal": "*". Note, that even though the IAM Documentation states that "Principal": "*" and "Principal": {"AWS": "*"} are equivalent, those principals have different behavior for IAM Role Trust Policy. Therefore this provider will normalize the principal field only in above-mentioned case and principals like type = "AWS" and identifiers = ["*"] will be rendered as "Principal": {"AWS": "*"}.

Parameters
  • override_json (str) – An IAM policy document to import and override the current policy document. Statements with non-blank sids in the override document will overwrite statements with the same sid in the current document. Statements without an sid cannot be overwritten.

  • policy_id (str) – An ID for the policy document.

  • source_json (str) – An IAM policy document to import as a base for the current policy document. Statements with non-blank sids in the current policy document will overwrite statements with the same sid in the source json. Statements without an sid cannot be overwritten.

  • statements (list) – A nested configuration block (described below) configuring one statement to be included in the policy document.

  • version (str) – IAM policy document version. Valid values: 2008-10-17, 2012-10-17. Defaults to 2012-10-17. For more information, see the AWS IAM User Guide.

The statements object supports the following:

  • actions (list) - A list of actions that this statement either allows or denies. For example, ["ec2:RunInstances", "s3:*"].

  • conditions (list) - A nested configuration block (described below) that defines a further, possibly-service-specific condition that constrains whether this statement applies.

    • test (str) - The name of the IAM condition operator to evaluate.

    • values (list) - The values to evaluate the condition against. If multiple values are provided, the condition matches if at least one of them applies. (That is, the tests are combined with the “OR” boolean operation.)

    • variable (str) - The name of a Context Variable to apply the condition to. Context variables may either be standard AWS variables starting with aws:, or service-specific variables prefixed with the service name.

  • effect (str) - Either “Allow” or “Deny”, to specify whether this statement allows or denies the given actions. The default is “Allow”.

  • notActions (list) - A list of actions that this statement does not apply to. Used to apply a policy statement to all actions except those listed.

  • notPrincipals (list) - Like principals except gives resources that the statement does not apply to.

    • identifiers (list) - List of identifiers for principals. When type is “AWS”, these are IAM user or role ARNs. When type is “Service”, these are AWS Service roles e.g. lambda.amazonaws.com.

    • type (str) - The type of principal. For AWS ARNs this is “AWS”. For AWS services (e.g. Lambda), this is “Service”.

  • notResources (list) - A list of resource ARNs that this statement does not apply to. Used to apply a policy statement to all resources except those listed.

  • principals (list) - A nested configuration block (described below) specifying a resource (or resource pattern) to which this statement applies.

    • identifiers (list) - List of identifiers for principals. When type is “AWS”, these are IAM user or role ARNs. When type is “Service”, these are AWS Service roles e.g. lambda.amazonaws.com.

    • type (str) - The type of principal. For AWS ARNs this is “AWS”. For AWS services (e.g. Lambda), this is “Service”.

  • resources (list) - A list of resource ARNs that this statement applies to. This is required by AWS if used for an IAM policy.

  • sid (str) - An ID for the policy statement.

pulumi_aws.iam.get_role(name=None, opts=None)

This data source can be used to fetch information about a specific IAM role. By using this data source, you can reference IAM role properties without having to hard code ARNs as input.

Parameters

name (str) – The friendly IAM role name to match.

pulumi_aws.iam.get_server_certificate(latest=None, name=None, name_prefix=None, path_prefix=None, opts=None)

Use this data source to lookup information about IAM Server Certificates.

The import function will read in certificate body, certificate chain (if it exists), id, name, path, and arn. It will not retrieve the private key which is not available through the AWS API.

Parameters
  • latest (bool) – sort results by expiration date. returns the certificate with expiration date in furthest in the future.

  • name (str) – exact name of the cert to lookup

  • name_prefix (str) – prefix of cert to filter by

  • path_prefix (str) – prefix of path to filter by

pulumi_aws.iam.get_user(user_name=None, opts=None)

This data source can be used to fetch information about a specific IAM user. By using this data source, you can reference IAM user properties without having to hard code ARNs or unique IDs as input.

Parameters

user_name (str) – The friendly IAM user name to match.