Module iam

iam

This provider is a derived work of the Terraform Provider distributed under MPL 2.0. If you encounter a bug or missing feature, first check the pulumi/pulumi-aws repo; however, if that doesn’t turn up anything, please consult the source terraform-providers/terraform-provider-aws repo.
class pulumi_aws.iam.AccessKey(resource_name, opts=None, pgp_key=None, status=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.
  • status (pulumi.Input[str]) – The access key status to apply. Defaults to Active. Valid values are Active and Inactive.
  • user (pulumi.Input[str]) – The IAM user to associate with this access key.
encrypted_secret = None

The encrypted secret, base64 encoded.

NOTE: The encrypted secret may be decrypted using the command line, for example: ... | base64 --decode | keybase pgp decrypt.
key_fingerprint = None

The fingerprint of the PGP key used to encrypt the secret

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.

secret = None

The secret access key. Note that this will be written to the state file. Please supply a pgp_key instead, which will prevent the secret from being stored in plain text

ses_smtp_password = None

The secret access key converted into an SES SMTP password by applying AWS’s documented conversion algorithm.

status = None

The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

user = None

The IAM user to associate with this access key.

static get(resource_name, id, opts=None, encrypted_secret=None, key_fingerprint=None, pgp_key=None, secret=None, ses_smtp_password=None, status=None, user=None)

Get an existing AccessKey resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] encrypted_secret: The encrypted secret, base64 encoded.

Parameters:
  • key_fingerprint (pulumi.Input[str]) – The fingerprint of the PGP key used to encrypt the secret
  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.
  • secret (pulumi.Input[str]) – The secret access key. Note that this will be written to the state file. Please supply a pgp_key instead, which will prevent the secret from being stored in plain text
  • ses_smtp_password (pulumi.Input[str]) –

    The secret access key converted into an SES SMTP password by applying AWS’s documented conversion algorithm.

  • status (pulumi.Input[str]) – The access key status to apply. Defaults to Active. Valid values are Active and Inactive.
  • user (pulumi.Input[str]) – The IAM user to associate with this access key.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.AccountAlias(resource_name, opts=None, account_alias=None, __props__=None, __name__=None, __opts__=None)
Note: There is only a single account alias per AWS account.

Manages the account alias for the AWS Account.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • account_alias (pulumi.Input[str]) – The account alias
account_alias = None

The account alias

static get(resource_name, id, opts=None, account_alias=None)

Get an existing AccountAlias resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] account_alias: The account alias

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.AccountPasswordPolicy(resource_name, opts=None, allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, __props__=None, __name__=None, __opts__=None)
Note: There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.

Manages Password Policy for the AWS Account. See more about Account Password Policy in the official AWS docs.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • allow_users_to_change_password (pulumi.Input[bool]) – Whether to allow users to change their own password
  • hard_expiry (pulumi.Input[bool]) – Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)
  • max_password_age (pulumi.Input[float]) – The number of days that an user password is valid.
  • minimum_password_length (pulumi.Input[float]) – Minimum length to require for user passwords.
  • password_reuse_prevention (pulumi.Input[float]) – The number of previous passwords that users are prevented from reusing.
  • require_lowercase_characters (pulumi.Input[bool]) – Whether to require lowercase characters for user passwords.
  • require_numbers (pulumi.Input[bool]) – Whether to require numbers for user passwords.
  • require_symbols (pulumi.Input[bool]) – Whether to require symbols for user passwords.
  • require_uppercase_characters (pulumi.Input[bool]) – Whether to require uppercase characters for user passwords.
allow_users_to_change_password = None

Whether to allow users to change their own password

expire_passwords = None

Indicates whether passwords in the account expire. Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present.

hard_expiry = None

Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

max_password_age = None

The number of days that an user password is valid.

minimum_password_length = None

Minimum length to require for user passwords.

password_reuse_prevention = None

The number of previous passwords that users are prevented from reusing.

require_lowercase_characters = None

Whether to require lowercase characters for user passwords.

require_numbers = None

Whether to require numbers for user passwords.

require_symbols = None

Whether to require symbols for user passwords.

require_uppercase_characters = None

Whether to require uppercase characters for user passwords.

static get(resource_name, id, opts=None, allow_users_to_change_password=None, expire_passwords=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None)

Get an existing AccountPasswordPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[bool] allow_users_to_change_password: Whether to allow users to change their own password :param pulumi.Input[bool] expire_passwords: Indicates whether passwords in the account expire.

Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present.
Parameters:
  • hard_expiry (pulumi.Input[bool]) – Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)
  • max_password_age (pulumi.Input[float]) – The number of days that an user password is valid.
  • minimum_password_length (pulumi.Input[float]) – Minimum length to require for user passwords.
  • password_reuse_prevention (pulumi.Input[float]) – The number of previous passwords that users are prevented from reusing.
  • require_lowercase_characters (pulumi.Input[bool]) – Whether to require lowercase characters for user passwords.
  • require_numbers (pulumi.Input[bool]) – Whether to require numbers for user passwords.
  • require_symbols (pulumi.Input[bool]) – Whether to require symbols for user passwords.
  • require_uppercase_characters (pulumi.Input[bool]) – Whether to require uppercase characters for user passwords.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.AwaitableGetAccountAliasResult(account_alias=None, id=None)
class pulumi_aws.iam.AwaitableGetGroupResult(arn=None, group_id=None, group_name=None, path=None, id=None)
class pulumi_aws.iam.AwaitableGetInstanceProfileResult(arn=None, create_date=None, name=None, path=None, role_arn=None, role_id=None, role_name=None, id=None)
class pulumi_aws.iam.AwaitableGetPolicyDocumentResult(json=None, override_json=None, policy_id=None, source_json=None, statements=None, version=None, id=None)
class pulumi_aws.iam.AwaitableGetPolicyResult(arn=None, description=None, name=None, path=None, policy=None, id=None)
class pulumi_aws.iam.AwaitableGetRoleResult(arn=None, assume_role_policy=None, create_date=None, description=None, max_session_duration=None, name=None, path=None, permissions_boundary=None, unique_id=None, id=None)
class pulumi_aws.iam.AwaitableGetServerCertificateResult(arn=None, certificate_body=None, certificate_chain=None, expiration_date=None, latest=None, name=None, name_prefix=None, path=None, path_prefix=None, upload_date=None, id=None)
class pulumi_aws.iam.AwaitableGetUserResult(arn=None, path=None, permissions_boundary=None, user_id=None, user_name=None, id=None)
class pulumi_aws.iam.GetAccountAliasResult(account_alias=None, id=None)

A collection of values returned by getAccountAlias.

account_alias = None

The alias associated with the AWS account.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetGroupResult(arn=None, group_id=None, group_name=None, path=None, id=None)

A collection of values returned by getGroup.

arn = None

The Amazon Resource Name (ARN) specifying the group.

group_id = None

The stable and unique string identifying the group.

path = None

The path to the group.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetInstanceProfileResult(arn=None, create_date=None, name=None, path=None, role_arn=None, role_id=None, role_name=None, id=None)

A collection of values returned by getInstanceProfile.

arn = None

The Amazon Resource Name (ARN) specifying the instance profile.

create_date = None

The string representation of the date the instance profile was created.

path = None

The path to the instance profile.

role_arn = None

The role arn associated with this instance profile.

role_id = None

The role id associated with this instance profile.

role_name = None

The role name associated with this instance profile.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyDocumentResult(json=None, override_json=None, policy_id=None, source_json=None, statements=None, version=None, id=None)

A collection of values returned by getPolicyDocument.

json = None

The above arguments serialized as a standard JSON policy document.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyResult(arn=None, description=None, name=None, path=None, policy=None, id=None)

A collection of values returned by getPolicy.

arn = None

The Amazon Resource Name (ARN) specifying the policy.

description = None

The description of the policy.

name = None

The name of the IAM policy.

path = None

The path to the policy.

policy = None

The policy document of the policy.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetRoleResult(arn=None, assume_role_policy=None, create_date=None, description=None, max_session_duration=None, name=None, path=None, permissions_boundary=None, unique_id=None, id=None)

A collection of values returned by getRole.

arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy document associated with the role.

create_date = None

Creation date of the role in RFC 3339 format.

description = None

Description for the role.

max_session_duration = None

Maximum session duration.

path = None

The path to the role.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

unique_id = None

The stable and unique string identifying the role.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetServerCertificateResult(arn=None, certificate_body=None, certificate_chain=None, expiration_date=None, latest=None, name=None, name_prefix=None, path=None, path_prefix=None, upload_date=None, id=None)

A collection of values returned by getServerCertificate.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetUserResult(arn=None, path=None, permissions_boundary=None, user_id=None, user_name=None, id=None)

A collection of values returned by getUser.

arn = None

The Amazon Resource Name (ARN) assigned by AWS for this user.

path = None

Path in which this user was created.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

user_id = None

The unique ID assigned by AWS for this user.

user_name = None

The name associated to this User

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.Group(resource_name, opts=None, name=None, path=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM group.

Parameters:
  • resource*name (str) –

    The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-*.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.
  • path (pulumi.Input[str]) – Path in which to create the group.
arn = None

The ARN assigned by AWS for this group.

name = None

The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

path = None

Path in which to create the group.

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, name=None, path=None, unique_id=None)

Get an existing Group resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resourcename: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS for this group. :param pulumi.Input[str] name: The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-.`. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”. :param pulumi.Input[str] path: Path in which to create the group. :param pulumi.Input[str] unique_id: The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupMembership(resource_name, opts=None, group=None, name=None, users=None, __props__=None, __name__=None, __opts__=None)
WARNING: Multiple iam.GroupMembership resources with the same group name will produce inconsistent behavior!

Provides a top level resource to manage IAM Group membership for IAM Users. For more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or [IAM Users][2]

Note: iam.GroupMembership will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the [iam.UserGroupMembership resource][3].
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The IAM Group name to attach the list of users to
  • name (pulumi.Input[str]) – The name to identify the Group Membership
  • users (pulumi.Input[list]) – A list of IAM User names to associate with the Group
group = None

The IAM Group name to attach the list of users to

name = None

The name to identify the Group Membership

users = None

A list of IAM User names to associate with the Group

static get(resource_name, id, opts=None, group=None, name=None, users=None)

Get an existing GroupMembership resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] group: The IAM Group name to attach the list of users to :param pulumi.Input[str] name: The name to identify the Group Membership :param pulumi.Input[list] users: A list of IAM User names to associate with the Group

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupPolicy(resource_name, opts=None, group=None, name=None, name_prefix=None, policy=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a group.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The IAM group to attach to the policy.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
group = None

The IAM group to attach to the policy.

name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

static get(resource_name, id, opts=None, group=None, name=None, name_prefix=None, policy=None)

Get an existing GroupPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] group: The IAM group to attach to the policy. :param pulumi.Input[str] name: The name of the policy. If omitted, this provider will

assign a random, unique name.
Parameters:
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupPolicyAttachment(resource_name, opts=None, group=None, policy_arn=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM group

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The group the policy should be applied to
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
group = None

The group the policy should be applied to

policy_arn = None

The ARN of the policy you want to apply

static get(resource_name, id, opts=None, group=None, policy_arn=None)

Get an existing GroupPolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] group: The group the policy should be applied to :param pulumi.Input[str] policy_arn: The ARN of the policy you want to apply

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.InstanceProfile(resource_name, opts=None, name=None, name_prefix=None, path=None, role=None, roles=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM instance profile.

NOTE: Either role or roles (deprecated) must be specified.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The profile’s name. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – Path in which to create the profile.
  • role (pulumi.Input[str]) – The role name to include in the profile.
  • roles (pulumi.Input[list]) – A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.
arn = None

The ARN assigned by AWS to the instance profile.

create_date = None

The creation timestamp of the instance profile.

name = None

The profile’s name. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the profile.

role = None

The role name to include in the profile.

roles = None

A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, create_date=None, name=None, name_prefix=None, path=None, role=None, roles=None, unique_id=None)

Get an existing InstanceProfile resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS to the instance profile. :param pulumi.Input[str] create_date: The creation timestamp of the instance profile. :param pulumi.Input[str] name: The profile’s name. If omitted, this provider will assign a random, unique name. :param pulumi.Input[str] name_prefix: Creates a unique name beginning with the specified prefix. Conflicts with name. :param pulumi.Input[str] path: Path in which to create the profile. :param pulumi.Input[str] role: The role name to include in the profile. :param pulumi.Input[list] roles:

A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase.
Parameters:unique_id (pulumi.Input[str]) – The [unique ID][1] assigned by AWS.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.OpenIdConnectProvider(resource_name, opts=None, client_id_lists=None, thumbprint_lists=None, url=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM OpenID Connect provider.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • client_id_lists (pulumi.Input[list]) – A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)
  • thumbprint_lists (pulumi.Input[list]) – A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).
  • url (pulumi.Input[str]) – The URL of the identity provider. Corresponds to the iss claim.
arn = None

The ARN assigned by AWS for this provider.

client_id_lists = None

A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)

thumbprint_lists = None

A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

url = None

The URL of the identity provider. Corresponds to the iss claim.

static get(resource_name, id, opts=None, arn=None, client_id_lists=None, thumbprint_lists=None, url=None)

Get an existing OpenIdConnectProvider resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS for this provider. :param pulumi.Input[list] client_id_lists: A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.) :param pulumi.Input[list] thumbprint_lists: A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s). :param pulumi.Input[str] url: The URL of the identity provider. Corresponds to the iss claim.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.Policy(resource_name, opts=None, description=None, name=None, name_prefix=None, path=None, policy=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • description (pulumi.Input[str]) – Description of the IAM policy.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – Path in which to create the policy. See IAM Identifiers for more information.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
arn = None

The ARN assigned by AWS to this policy.

description = None

Description of the IAM policy.

name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the policy. See IAM Identifiers for more information.

policy = None

The policy document. This is a JSON formatted string.

static get(resource_name, id, opts=None, arn=None, description=None, name=None, name_prefix=None, path=None, policy=None)

Get an existing Policy resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS to this policy. :param pulumi.Input[str] description: Description of the IAM policy. :param pulumi.Input[str] name: The name of the policy. If omitted, this provider will assign a random, unique name. :param pulumi.Input[str] name_prefix: Creates a unique name beginning with the specified prefix. Conflicts with name. :param pulumi.Input[str] path: Path in which to create the policy.

See IAM Identifiers for more information.
Parameters:policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.PolicyAttachment(resource_name, opts=None, groups=None, name=None, policy_arn=None, roles=None, users=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)

!> WARNING: The iam.PolicyAttachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single iam.PolicyAttachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other resources managed by this provider) will have that attached policy revoked by this resource. Consider iam.RolePolicyAttachment, iam.UserPolicyAttachment, or iam.GroupPolicyAttachment instead. These resources do not enforce exclusive attachment of an IAM policy.

NOTE: The usage of this resource conflicts with the iam.GroupPolicyAttachment, iam.RolePolicyAttachment, and iam.UserPolicyAttachment resources and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • groups (pulumi.Input[list]) – The group(s) the policy should be applied to
  • name (pulumi.Input[str]) – The name of the attachment. This cannot be an empty string.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • roles (pulumi.Input[list]) – The role(s) the policy should be applied to
  • users (pulumi.Input[list]) – The user(s) the policy should be applied to
groups = None

The group(s) the policy should be applied to

name = None

The name of the attachment. This cannot be an empty string.

policy_arn = None

The ARN of the policy you want to apply

roles = None

The role(s) the policy should be applied to

users = None

The user(s) the policy should be applied to

static get(resource_name, id, opts=None, groups=None, name=None, policy_arn=None, roles=None, users=None)

Get an existing PolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[list] groups: The group(s) the policy should be applied to :param pulumi.Input[str] name: The name of the attachment. This cannot be an empty string. :param pulumi.Input[str] policy_arn: The ARN of the policy you want to apply :param pulumi.Input[list] roles: The role(s) the policy should be applied to :param pulumi.Input[list] users: The user(s) the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.Role(resource_name, opts=None, assume_role_policy=None, description=None, force_detach_policies=None, max_session_duration=None, name=None, name_prefix=None, path=None, permissions_boundary=None, tags=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM role.

NOTE: If policies are attached to the role via the ``iam.PolicyAttachment` resource <https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html>`_ and you are modifying the role name or path, the force_detach_policies argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The ``iam.RolePolicyAttachment` resource (recommended) <https://www.terraform.io/docs/providers/aws/r/iam_role_policy_attachment.html>`_ does not have this requirement.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • assume_role_policy (pulumi.Input[str]) – The policy that grants an entity permission to assume the role.
  • description (pulumi.Input[str]) – The description of the role.
  • force_detach_policies (pulumi.Input[bool]) – Specifies to force detaching any policies the role has before destroying it. Defaults to false.
  • max_session_duration (pulumi.Input[float]) – The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
  • name (pulumi.Input[str]) – The name of the role. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) –

    The path to the role. See IAM Identifiers for more information.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the role.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM role
arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy that grants an entity permission to assume the role.

create_date = None

The creation date of the IAM role.

description = None

The description of the role.

force_detach_policies = None

Specifies to force detaching any policies the role has before destroying it. Defaults to false.

max_session_duration = None

The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

name = None

The name of the role. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The path to the role. See IAM Identifiers for more information.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

tags = None

Key-value mapping of tags for the IAM role

unique_id = None

The stable and unique string identifying the role.

static get(resource_name, id, opts=None, arn=None, assume_role_policy=None, create_date=None, description=None, force_detach_policies=None, max_session_duration=None, name=None, name_prefix=None, path=None, permissions_boundary=None, tags=None, unique_id=None)

Get an existing Role resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) specifying the role. :param pulumi.Input[str] assume_role_policy: The policy that grants an entity permission to assume the role. :param pulumi.Input[str] create_date: The creation date of the IAM role. :param pulumi.Input[str] description: The description of the role. :param pulumi.Input[bool] force_detach_policies: Specifies to force detaching any policies the role has before destroying it. Defaults to false. :param pulumi.Input[float] max_session_duration: The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours. :param pulumi.Input[str] name: The name of the role. If omitted, this provider will assign a random, unique name. :param pulumi.Input[str] name_prefix: Creates a unique name beginning with the specified prefix. Conflicts with name. :param pulumi.Input[str] path: The path to the role.

See IAM Identifiers for more information.
Parameters:
  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the role.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM role
  • unique_id (pulumi.Input[str]) – The stable and unique string identifying the role.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.RolePolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, role=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM role policy.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the role policy. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
  • role (pulumi.Input[str]) – The IAM role to attach to the policy.
name = None

The name of the role policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

role = None

The IAM role to attach to the policy.

static get(resource_name, id, opts=None, name=None, name_prefix=None, policy=None, role=None)

Get an existing RolePolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] name: The name of the role policy. If omitted, this provider will

assign a random, unique name.
Parameters:
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
  • role (pulumi.Input[str]) – The IAM role to attach to the policy.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.RolePolicyAttachment(resource_name, opts=None, policy_arn=None, role=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM role

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • role (pulumi.Input[str]) – The role the policy should be applied to
policy_arn = None

The ARN of the policy you want to apply

role = None

The role the policy should be applied to

static get(resource_name, id, opts=None, policy_arn=None, role=None)

Get an existing RolePolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] policy_arn: The ARN of the policy you want to apply :param pulumi.Input[str] role: The role the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.SamlProvider(resource_name, opts=None, name=None, saml_metadata_document=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM SAML provider.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the provider to create.
  • saml_metadata_document (pulumi.Input[str]) – An XML document generated by an identity provider that supports SAML 2.0.
arn = None

The ARN assigned by AWS for this provider.

name = None

The name of the provider to create.

saml_metadata_document = None

An XML document generated by an identity provider that supports SAML 2.0.

valid_until = None

The expiration date and time for the SAML provider in RFC1123 format, e.g. Mon, 02 Jan 2006 15:04:05 MST.

static get(resource_name, id, opts=None, arn=None, name=None, saml_metadata_document=None, valid_until=None)

Get an existing SamlProvider resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS for this provider. :param pulumi.Input[str] name: The name of the provider to create. :param pulumi.Input[str] saml_metadata_document: An XML document generated by an identity provider that supports SAML 2.0. :param pulumi.Input[str] valid_until: The expiration date and time for the SAML provider in RFC1123 format, e.g. Mon, 02 Jan 2006 15:04:05 MST.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.ServerCertificate(resource_name, opts=None, arn=None, certificate_body=None, certificate_chain=None, name=None, name_prefix=None, path=None, private_key=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM Server Certificate resource to upload Server Certificates. Certs uploaded to IAM can easily work with other AWS services such as:

  • AWS Elastic Beanstalk
  • Elastic Load Balancing
  • CloudFront
  • AWS OpsWorks

For information about server certificates in IAM, see [Managing Server Certificates][2] in AWS Documentation.

Note: All arguments including the private key will be stored in the raw state as plain-text. Read more about sensitive data in state.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the server certificate.
  • certificate_body (pulumi.Input[str]) – The contents of the public key certificate in PEM-encoded format.
  • certificate_chain (pulumi.Input[str]) – The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.
  • name (pulumi.Input[str]) – The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.
  • private_key (pulumi.Input[str]) – The contents of the private key in PEM-encoded format.
arn = None

The Amazon Resource Name (ARN) specifying the server certificate.

certificate_body = None

The contents of the public key certificate in PEM-encoded format.

certificate_chain = None

The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

name = None

The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.

private_key = None

The contents of the private key in PEM-encoded format.

static get(resource_name, id, opts=None, arn=None, certificate_body=None, certificate_chain=None, name=None, name_prefix=None, path=None, private_key=None)

Get an existing ServerCertificate resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) specifying the server certificate. :param pulumi.Input[str] certificate_body: The contents of the public key certificate in

PEM-encoded format.
Parameters:
  • certificate_chain (pulumi.Input[str]) – The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.
  • name (pulumi.Input[str]) – The name of the Server Certificate. Do not include the path in this value. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.
  • private_key (pulumi.Input[str]) – The contents of the private key in PEM-encoded format.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.ServiceLinkedRole(resource_name, opts=None, aws_service_name=None, custom_suffix=None, description=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM service-linked role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • aws_service_name (pulumi.Input[str]) – The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.
  • custom_suffix (pulumi.Input[str]) – Additional string appended to the role name. Not all AWS services support custom suffixes.
  • description (pulumi.Input[str]) – The description of the role.
arn = None

The Amazon Resource Name (ARN) specifying the role.

aws_service_name = None

The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.

create_date = None

The creation date of the IAM role.

custom_suffix = None

Additional string appended to the role name. Not all AWS services support custom suffixes.

description = None

The description of the role.

name = None

The name of the role.

path = None

The path of the role.

unique_id = None

The stable and unique string identifying the role.

static get(resource_name, id, opts=None, arn=None, aws_service_name=None, create_date=None, custom_suffix=None, description=None, name=None, path=None, unique_id=None)

Get an existing ServiceLinkedRole resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The Amazon Resource Name (ARN) specifying the role. :param pulumi.Input[str] aws_service_name: The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs. :param pulumi.Input[str] create_date: The creation date of the IAM role. :param pulumi.Input[str] custom_suffix: Additional string appended to the role name. Not all AWS services support custom suffixes. :param pulumi.Input[str] description: The description of the role. :param pulumi.Input[str] name: The name of the role. :param pulumi.Input[str] path: The path of the role. :param pulumi.Input[str] unique_id: The stable and unique string identifying the role.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.SshKey(resource_name, opts=None, encoding=None, public_key=None, status=None, username=None, __props__=None, __name__=None, __opts__=None)

Uploads an SSH public key and associates it with the specified IAM user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • encoding (pulumi.Input[str]) – Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.
  • public_key (pulumi.Input[str]) – The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.
  • status (pulumi.Input[str]) – The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.
  • username (pulumi.Input[str]) – The name of the IAM user to associate the SSH public key with.
encoding = None

Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.

fingerprint = None

The MD5 message digest of the SSH public key.

public_key = None

The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.

ssh_public_key_id = None

The unique identifier for the SSH public key.

status = None

The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.

username = None

The name of the IAM user to associate the SSH public key with.

static get(resource_name, id, opts=None, encoding=None, fingerprint=None, public_key=None, ssh_public_key_id=None, status=None, username=None)

Get an existing SshKey resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] encoding: Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM. :param pulumi.Input[str] fingerprint: The MD5 message digest of the SSH public key. :param pulumi.Input[str] public_key: The SSH public key. The public key must be encoded in ssh-rsa format or PEM format. :param pulumi.Input[str] ssh_public_key_id: The unique identifier for the SSH public key. :param pulumi.Input[str] status: The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active. :param pulumi.Input[str] username: The name of the IAM user to associate the SSH public key with.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.User(resource_name, opts=None, force_destroy=None, name=None, path=None, permissions_boundary=None, tags=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM user.

NOTE: If policies are attached to the user via the ``iam.PolicyAttachment` resource <https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html>`_ and you are modifying the user name or path, the force_destroy argument must be set to true and applied before attempting the operation otherwise you will encounter a DeleteConflict error. The ``iam.UserPolicyAttachment` resource (recommended) <https://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html>`_ does not have this requirement.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • force_destroy (pulumi.Input[bool]) – When destroying this user, destroy even if it has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.
  • name (pulumi.Input[str]) – The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.
  • path (pulumi.Input[str]) – Path in which to create the user.
  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the user.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM user
arn = None

The ARN assigned by AWS for this user.

force_destroy = None

When destroying this user, destroy even if it has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.

name = None

The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.

path = None

Path in which to create the user.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

tags = None

Key-value mapping of tags for the IAM user

unique_id = None

The [unique ID][1] assigned by AWS.

static get(resource_name, id, opts=None, arn=None, force_destroy=None, name=None, path=None, permissions_boundary=None, tags=None, unique_id=None)

Get an existing User resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] arn: The ARN assigned by AWS for this user. :param pulumi.Input[bool] force_destroy: When destroying this user, destroy even if it

has non-this provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-this provider-managed access keys and login profile will fail to be destroyed.
Parameters:
  • name (pulumi.Input[str]) – The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.
  • path (pulumi.Input[str]) – Path in which to create the user.
  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the user.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM user
  • unique_id (pulumi.Input[str]) – The [unique ID][1] assigned by AWS.
translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserGroupMembership(resource_name, opts=None, groups=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides a resource for adding an [IAM User][2] to [IAM Groups][1]. This resource can be used multiple times with the same user for non-overlapping groups.

To exclusively manage the users in a group, see the [iam.GroupMembership resource][3].

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • groups (pulumi.Input[list]) – A list of [IAM Groups][1] to add the user to
  • user (pulumi.Input[str]) – The name of the [IAM User][2] to add to groups
groups = None

A list of [IAM Groups][1] to add the user to

user = None

The name of the [IAM User][2] to add to groups

static get(resource_name, id, opts=None, groups=None, user=None)

Get an existing UserGroupMembership resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[list] groups: A list of [IAM Groups][1] to add the user to :param pulumi.Input[str] user: The name of the [IAM User][2] to add to groups

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserLoginProfile(resource_name, opts=None, password_length=None, password_reset_required=None, pgp_key=None, user=None, __props__=None, __name__=None, __opts__=None)

Manages an IAM User Login Profile with limited support for password creation during this provider resource creation. Uses PGP to encrypt the password for safe transport to the user. PGP keys can be obtained from Keybase.

To reset an IAM User login password via this provider, you can use delete and recreate this resource or change any of the arguments.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • password_length (pulumi.Input[float]) – The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.
  • password_reset_required (pulumi.Input[bool]) – Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.
  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.
  • user (pulumi.Input[str]) – The IAM user’s name.
encrypted_password = None

The encrypted password, base64 encoded. Only available if password was handled on this provider resource creation, not import.

key_fingerprint = None

The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on this provider resource creation, not import.

password_length = None

The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

password_reset_required = None

Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.

user = None

The IAM user’s name.

static get(resource_name, id, opts=None, encrypted_password=None, key_fingerprint=None, password_length=None, password_reset_required=None, pgp_key=None, user=None)

Get an existing UserLoginProfile resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] encrypted_password: The encrypted password, base64 encoded. Only available if password was handled on this provider resource creation, not import. :param pulumi.Input[str] key_fingerprint: The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on this provider resource creation, not import. :param pulumi.Input[float] password_length: The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument. :param pulumi.Input[bool] password_reset_required: Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument. :param pulumi.Input[str] pgp_key: Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument. :param pulumi.Input[str] user: The IAM user’s name.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserPolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, user=None, __props__=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, this provider will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string.
  • user (pulumi.Input[str]) – IAM user to which to attach this policy.
name = None

The name of the policy. If omitted, this provider will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string.

user = None

IAM user to which to attach this policy.

static get(resource_name, id, opts=None, name=None, name_prefix=None, policy=None, user=None)

Get an existing UserPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] name: The name of the policy. If omitted, this provider will assign a random, unique name. :param pulumi.Input[str] name_prefix: Creates a unique name beginning with the specified prefix. Conflicts with name. :param pulumi.Input[str] policy: The policy document. This is a JSON formatted string. :param pulumi.Input[str] user: IAM user to which to attach this policy.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserPolicyAttachment(resource_name, opts=None, policy_arn=None, user=None, __props__=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM user

NOTE: The usage of this resource conflicts with the iam.PolicyAttachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • user (pulumi.Input[str]) – The user the policy should be applied to
policy_arn = None

The ARN of the policy you want to apply

user = None

The user the policy should be applied to

static get(resource_name, id, opts=None, policy_arn=None, user=None)

Get an existing UserPolicyAttachment resource’s state with the given name, id, and optional extra properties used to qualify the lookup. :param str resource_name: The unique name of the resulting resource. :param str id: The unique provider ID of the resource to lookup. :param pulumi.ResourceOptions opts: Options for the resource. :param pulumi.Input[str] policy_arn: The ARN of the policy you want to apply :param pulumi.Input[str] user: The user the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
pulumi_aws.iam.get_account_alias(opts=None)

The IAM Account Alias data source allows access to the account alias for the effective account in which this provider is working.

pulumi_aws.iam.get_group(group_name=None, opts=None)

This data source can be used to fetch information about a specific IAM group. By using this data source, you can reference IAM group properties without having to hard code ARNs as input.

pulumi_aws.iam.get_instance_profile(name=None, opts=None)

This data source can be used to fetch information about a specific IAM instance profile. By using this data source, you can reference IAM instance profile properties without having to hard code ARNs as input.

pulumi_aws.iam.get_policy(arn=None, opts=None)

This data source can be used to fetch information about a specific IAM policy.

pulumi_aws.iam.get_policy_document(override_json=None, policy_id=None, source_json=None, statements=None, version=None, opts=None)

Generates an IAM policy document in JSON format.

This is a data source which can be used to construct a JSON representation of an IAM policy document, for use with resources which expect policy documents, such as the iam.Policy resource.

Using this data source to generate policy documents is optional. It is also valid to use literal JSON strings within your configuration, or to use the file interpolation function to read a raw JSON policy document from a file.

The IAM policy document format allows context variables to be interpolated into various strings within a statement. The native IAM policy document format uses ${...}-style syntax that is in conflict with interpolation syntax, so this data source instead uses &{...} syntax for interpolations that should be processed by AWS rather than by this provider.

In order to define wildcard principal (a.k.a. anonymous user) use type = "*" and identifiers = ["*"]. In that case the rendered json will contain "Principal": "*". Note, that even though the IAM Documentation states that "Principal": "*" and "Principal": {"AWS": "*"} are equivalent, those principals have different behavior for IAM Role Trust Policy. Therefore this provider will normalize the principal field only in above-mentioned case and principals like type = "AWS" and identifiers = ["*"] will be rendered as "Principal": {"AWS": "*"}.

pulumi_aws.iam.get_role(name=None, opts=None)

This data source can be used to fetch information about a specific IAM role. By using this data source, you can reference IAM role properties without having to hard code ARNs as input.

pulumi_aws.iam.get_server_certificate(latest=None, name=None, name_prefix=None, path_prefix=None, opts=None)

Use this data source to lookup information about IAM Server Certificates.

The import function will read in certificate body, certificate chain (if it exists), id, name, path, and arn. It will not retrieve the private key which is not available through the AWS API.

pulumi_aws.iam.get_user(user_name=None, opts=None)

This data source can be used to fetch information about a specific IAM user. By using this data source, you can reference IAM user properties without having to hard code ARNs or unique IDs as input.