AWS - IAM

Use this integration to manage identity and access on the AWS platform.

We recommend that you use roles that have the following bulit-in AWS policies:

IAMFullAccess
IAMReadOnlyAccess

Prerequisites

It is important that you familiarize yourself with and complete all steps detailed in the AWS Integrations - Authentication .

Configure the AWS IAM Integration on Demisto

Navigate to Settings > Integrations > Servers & Services .
Search for AWS - IAM.
Click Add instance to create and configure a new integration instance.
- Name : a textual name for the integration instance.
- Role Arn
- Role Session Name
- Role Session Duration
Click Test to validate the URLs and token.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Create a user: aws-iam-create-user
Get user information: aws-iam-get-user
Get a list of users: aws-iam-list-users
Update user information: aws-iam-update-user
Delete a user: aws-iam-delete-user
Update a user's password: aws-iam-login-profile
Create a group: aws-iam-create-group
Get a list of groups: aws-iam-list-groups
List all groups a user is part of: aws-iam-list-groups-for-user
Add a user to a group: aws-iam-add-user-to-group
Create an access key: aws-iam-create-access-key
Update an access key: aws-iam-update-access-key
List all access keys for a user: aws-iam-list-access-keys-for-user
List all policies: aws-iam-list-policies
List all roles: aws-iam-list-roles
Attach a policy to an entity: aws-iam-attach-policy
Detach a policy from an entity: aws-iam-detach-policy
Delete a user's password: aws-iam-delete-login-profile
Delete a group: aws-iam-delete-group
Remove a user from a group: aws-iam-remove-user-from-group
Create a password for a user: aws-iam-create-login-profile
Delete an access key: aws-iam-delete-access-key
Create an instance profile: aws-iam-create-instance-profile
Delete an instance profile: aws-iam-delete-instance-profile
List all instance profiles: aws-iam-list-instance-profiles
Add a role to an instance profile: aws-iam-add-role-to-instance-profile
Remove a role from an instance profile: aws-iam-remove-role-from-instance-profile
List all instance profiles for a role: aws-iam-list-instance-profiles-for-role
Get instance profile information: aws-iam-get-instance-profile
Get role information: aws-iam-get-role
Delete a role: aws-iam-delete-role
Create a role: aws-iam-create-role
Create a policy: aws-iam-create-policy
Delete a policy: aws-iam-delete-policy
Create a new version of a policy: aws-iam-create-policy-version
Delete a version of a policy: aws-iam-delete-policy-version
Get information for all versions of a policy: aws-iam-list-policy-versions
Get information for a policy version: aws-iam-get-policy-version
Set a default (operative) policy version: aws-iam-set-default-policy-version
Create an account alias: aws-iam-create-account-alias
Delete an account alias: aws-iam-delete-account-alias

1. Create a user

Creates a user in the Amazon IAM system.

Command Example

!aws-iam-create-user userName=Test path=/testusers/

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateUser

Input

Parameter	Description
userName	Name of the user to create
path	Path for the username. This parameter is optional. If it is not included in the command, it defaults to a forward slash (/).
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.Route53.RecordSetsChange.Id	Request ID
AWS.Route53.RecordSetsChange.Status	Current state of the request. PENDING indicates that the request has not yet been applied to all Amazon Route 53 DNS servers.
AWS.Route53.RecordSetsChange.Comment	A complex type that describes change information about changes made to your hosted zone.

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:user/testusers/Test2",
   "CreateDate":"2018-06-04T12:12:20",
   "Path":"/testusers/",
   "UserId":"AIDSECGFSTGLFJWJXSXMC",
   "UserName":"Test2"
}

2. Get user information

Returns information about a user in the Amazon IAM system.

Command Example

!aws-iam-get-user userName=test

AWS IAM Policy Permission

Effect: Allow
Action: iam:GetUser

Input

Parameter	Description
userName	Name of the user to create
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Users.UserName	Friendly name to identify the user
AWS.IAM.Users.UserId	stable and unique string identifying the user
AWS.IAM.Users.Arn	Amazon Resource Name (ARN) that identifies the user
AWS.IAM.Users.CreateDate	Date and time when the user was created
AWS.IAM.Users.Path	Path to the user
AWS.IAM.Users.PasswordLastUsed	Date and time when the user's password was last used to sign in to an AWS website

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:user/testusers/Test",
   "CreateDate":"2018-06-04T12:11:20",
   "Path":"/testusers/",
   "UserId":"AIDASDADJDHKMTAUTCUZRQH26",
   "UserName":"Test"
}

3. Get a list of users

Returns a list of all users in the Amazon IAM system.

Command Example

!aws-iam-list-users

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListUsers

Input

Parameter	Description
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Users.UserName	Friendly name to identify the user
AWS.IAM.Users.UserId	Stable and unique string identifying the user
AWS.IAM.Users.Arn	Amazon Resource Name (ARN) that identifies the user
AWS.IAM.Users.CreateDate	Date and time when the user was created
AWS.IAM.Users.Path	Path to the user

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:user/testusers/Test",
      "CreateDate":"2018-06-04 12:11:20",
      "Path":"/testusers/",
      "UserId":"AIDASFDASFSAJDHKMTAUTCUZRQH26",
      "UserName":"Test"
   },
   {  
      "Arn":"arn:aws:iam::123456789:user/testusers/Test2",
      "CreateDate":"2018-06-04 12:12:20",
      "Path":"/testusers/",
      "UserId":"AIDAI3Z2WTADFADGAGLFJWJXSXMC",
      "UserName":"Test2"
   }
]

4. Update user information

Returns a list of all users in the Amazon IAM system.

Command Example

!aws-iam-update-user oldUserName=test newUserName=NewUserName34 newPath=/iamtest/

AWS IAM Policy Permission

Effect: Allow
Action: iam:UpdateUser

Input

Parameter	Description
oldUserName	Name of the user to update
newUserName	New name for the user. Include this parameter only if you are changing the user's name.
newPath	New path for the user. Include this parameter only if you are changing the user's path.
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

Changed UserName test To: NewUserName34

5. Delete a user

Deletes a user from the the Amazon IAM system.

Command Example

!aws-iam-delete-user userName=userName34

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteUser

Input

Parameter	Description
userName	Name of the user to delete
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The user userName34 has been deleted

6. Update a user's password

Update the password for a user in the the Amazon IAM system.

Command Example

!aws-iam-update-login-profile userName=userName34 newPassword=ArdVaEC@1#$F%g% passwordResetRequired=True raw-response=true

AWS IAM Policy Permission

Effect: Allow
Action: iam:UpdateLoginProfile

Input

Parameter	Description
userName	Name of the user you want to update the password for
newPassword	New password for the specified IAM user
passwordResetRequired	Specifies whether the user is required to set a new password on next sign in.
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The password for user userName34 was changed.

7. Create a group

Creates a group in the Amazon IAM system.

Command Example

!aws-iam-create-group groupName=test path=/testgroups/

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateGroup

Input

Parameter	Description
groupName	Name of the group to create. Do not include the path in this value.
path	Path to the group
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Groups.GroupName	Friendly name to identify the group
AWS.IAM.Groups.GroupId	Stable and unique string identifying the group
AWS.IAM.Groups.Arn	Amazon Resource Name (ARN) that specifies the group
AWS.IAM.Groups.CreateDate	Date and time when the group was created
AWS.IAM.Groups.Path	Path to the group

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:group/testgroups/test",
   "CreateDate":"2018-06-04T13:32:34",
   "GroupId":"AGPAJH6IZW4TASFDUWDJVPQG",
   "GroupName":"test",
   "Path":"/testgroups/"
}

8. Get a list of groups

Returns a list of all groups in the Amazon IAM system.

Command Example

!aws-iam-list-groups

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListGroups

Input

Parameter	Description
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Groups.GroupName	Friendly name to identify the group
AWS.IAM.Groups.GroupId	Stable and unique string identifying the group
AWS.IAM.Groups.Arn	Amazon Resource Name (ARN) that specifies the group
AWS.IAM.Groups.CreateDate	Date and time when the group was created
AWS.IAM.Groups.Path	Path to the group

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:group/Admins",
      "CreateDate":"2017-11-01T08:32:39",
      "GroupId":"AGPAJVFASADEZ5LCW",
      "GroupName":"Admins",
      "Path":"/"
   },
   {  
      "Arn":"arn:aws:iam::123456789:group/Developers",
      "CreateDate":"2017-11-01T08:33:22",
      "GroupId":"AGPAI2DADAD3V4XGPRNRCVZYCG",
      "GroupName":"Developers",
      "Path":"/"
   },
   {  
      "Arn":"arn:aws:iam::123456789:group/testgroups/test",
      "CreateDate":"2018-06-04T13:32:34",
      "GroupId":"AGPAJH6IZWADFASD4TDUWDJVPQG",
      "GroupName":"test",
      "Path":"/testgroups/"
   }
]

9. List all groups a user is part of

Returns a list of all groups that a specified user is part of in the Amazon IAM system.

Command Example

!aws-iam-list-groups-for-user userName=test

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListGroupsForUser

Input

Parameter	Description
userName	Name of the user to list groups for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Groups.GroupName	Friendly name to identify the group
AWS.IAM.Groups.GroupId	Stable and unique string identifying the group
AWS.IAM.Groups.Arn	Amazon Resource Name (ARN) that specifies the group
AWS.IAM.Groups.CreateDate	Date and time when the group was created
AWS.IAM.Groups.Path	Path to the group

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:group/testgroups/test",
      "CreateDate":"2018-06-04T13:32:34",
      "GroupId":"AGPAJH6IZSAFW4TDUWDJVPQG",
      "GroupName":"test",
      "Path":"/testgroups/",
      "UserName":"test"
   }
]

10. Add a user to a group

Adds an IAM user to a group in the Amazon IAM system.

Command Example

!aws-iam-add-user-to-group userName=userName34 groupName=test

AWS IAM Policy Permission

Effect: Allow
Action: iam:AddUserToGroup

Input

Parameter	Description
userName	Name of the user to add to a group
groupName	Name of the group to add the user to
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The user userName34 was added to the IAM group: test.

11. Create an access key

Creates an access key for an IAM user in the Amazon IAM system.

Command Example

!aws-iam-create-access-key userName=userName34

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateAccessKey

Input

Parameter	Description
userName	Name of the user the key is created for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Users.AccessKeys.AccessKeyId	ID for this access key
AWS.IAM.Users.AccessKeys.SecretAccessKey	Secret key used to sign requests
AWS.IAM.Users.AccessKeys.Status	Status of the access key. Active means that the key is valid for API calls, Inactive means it is not valid for API calls.
AWS.IAM.Users.AccessKeys.CreateDate	Access key creation date

Raw Output

{  
   "AccessKeyId":"AKIASADI6QUYJTFBVHEC5WA",
   "CreateDate":"2018-06-05T06:19:00",
   "SecretAccessKey":"Yj2WWHtipDADADDgZoU7Bvl",
   "Status":"Active",
   "UserName":"userName34"
}

12. Update an access key

Changes the status of an access key for an IAM user in the Amazon IAM system.

Command Example

!aws-iam-update-access-key userName=test accessKeyId=AKIAJSFAUQ7EDFPN7Y2D2A status=Inactive

AWS IAM Policy Permission

Effect: Allow
Action: iam:UpdateAccessKey

Input

Parameter	Description
userName	Name of the user you want to update the access key for
accessKeyId	ID of the access key you want to update
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

Access Key with ID AKIAJUQASDAF7E7X5PY2D2A was set to status: Inactive.

13. List all access keys for a user

Lists all access keys for an IAM user in the Amazon IAM system.

Command Example

!aws-iam-list-access-keys-for-user userName=userName34

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListAccessKeys

Input

Parameter	Description
userName	Name of the user you want to list all keys for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Users.AccessKeys.AccessKeyId	ID for this access key
AWS.IAM.Users.AccessKeys.Status	Status of the access key. Active means that the key is valid for API calls, Inactive means it is not valid for API calls.
AWS.IAM.Users.AccessKeys.CreateDate	Access key creation date
AWS.IAM.Users.AccessKeys.UserName	Name of the IAM user that the key is associated with

Raw Output

[  
   {  
      "AccessKeyId":"AKISFX5PN7Y2D2A",
      "CreateDate":"2018-06-05T06:19:44",
      "Status":"Inactive",
      "UserName":"userName34"
   },
   {  
      "AccessKeyId":"AKIAI6SFAQUYJTFBVHEC5WA",
      "CreateDate":"2018-06-05T06:19:00",
      "Status":"Active",
      "UserName":"userName34"
   }
]

14. List all policies

Lists all policies, either AWS managed policies or locally managed policies.

Command Example

!aws-iam-list-policies scope=AWS onlyAttached=True

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListPolicies

Input

Parameter	Description
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Policies.PolicyName	Friendly name identifying the policy (not the ARN)
AWS.IAM.Policies.PolicyId	Stable and unique string identifying the policy
AWS.IAM.Policies.Arn	Amazon Resource Name (ARN)
AWS.IAM.Policies.Path	Path to the policy.
AWS.IAM.Policies.DefaultVersionId	Identifier for the version of the policy that is set as the default version
AWS.IAM.Policies.IsAttachable	Specifies whether the policy can be attached to an IAM user, group, or role
AWS.IAM.Policies.CreateDate	Policy creation date
AWS.IAM.Policies.UpdateDate	Date policy was last updated
AWS.IAM.Policies.AttachmentCount	Number of entities (users, groups, and roles) that the policy is attached to

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::aws:policy/AmazonEC2FullAccess",
      "AttachmentCount":1,
      "CreateDate":"2015-02-06T18:40:15",
      "DefaultVersionId":"v4",
      "IsAttachable":true,
      "Path":"/",
      "PolicyId":"ANPAI3VAJF5ZCRZ7MCQE6",
      "PolicyName":"AmazonEC2FullAccess",
      "UpdateDate":"2018-02-08T18:11:24"
   },
   {  
      "Arn":"arn:aws:iam::aws:policy/AmazonSQSFullAccess",
      "AttachmentCount":1,
      "CreateDate":"2015-02-06T18:41:07",
      "DefaultVersionId":"v1",
      "IsAttachable":true,
      "Path":"/",
      "PolicyId":"ANPAI65L554VRJ33ECQS6",
      "PolicyName":"AmazonSQSFullAccess",
      "UpdateDate":"2015-02-06T18:41:07"
   }
]

15. List all roles

Lists all roles in the Amazon IAM system.

Command Example

!aws-iam-list-roles

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListRoles

Input

Parameter	Description
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.Roles.CreateDate	Date and time the role was created
AWS.IAM.Roles.Path	Path to the role
AWS.IAM.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.Roles.Description	Description of the role that you provide
AWS.IAM.Roles.MaxSessionDuration	The maximum session duration (in seconds) for the specified role. Anyone who uses the AWS CLI or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:role/AdminAccess",
      "CreateDate":"2018-05-11T11:27:02",
      "Path":"/",
      "RoleId":"AROAIASM66GZ3IZaDY645EFQ",
      "RoleName":"AdminAccess"
   },
   {  
      "Arn":"arn:aws:iam::123456789:role/service-role/AMI_Info",
      "CreateDate":"2018-04-22T19:14:14",
      "Path":"/service-role/",
      "RoleId":"AROAADIECFBPADNVAAS2ADKTHG4",
      "RoleName":"AMI_Info"
   }
]

16. Attach a policy to an entity

Attach a policy to an entity in the Amazon IAM system.

Command Example

!aws-iam-attach-policy type=User entityName=userName34 policyArn=arn:aws:iam::aws:policy/AmazonSQSFullAccess

AWS IAM Policy Permission

Effect: Allow
Actions: iam:AttachGroupPolicy , iam:AttachRolePolicy , iam:AttachUserPolicy

Input

Parameter	Description
type	IAM entity type
entityName	Friendly name of the IAM entity to attach the policy to (not the ARN)
policyArn	Amazon Resource Name (ARN) of the IAM policy you want to attach

Context Output

There is no context output for this command.

Raw Output

Policy was attached to User: userName34

17. Detach a policy from an entity

Detaches a policy from an IAM entity in the Amazon IAM system.

Command Example

!aws-iam-detach-policy type=User entityName=userName34 policyArn=arn:aws:iam::aws:policy/AmazonSQSFullAccess

AWS IAM Policy Permission

Effect: Allow
Actions: iam:DetachGroupPolicy , iam:DetachRolePolicy , iam:DetachUserPolicy

Input

Parameter	Description
type	IAM entity type
entityName	Friendly name of the IAM entity to detach the policy from (not ARN)
policyArn	Amazon Resource Name (ARN) of the policy to detach
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

Policy was detached from User: userName34

18. Delete a user's password

Delete the password of an IAM entity in the Amazon IAM system.

Command Example

!aws-iam-delete-login-profile userName=userName34

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteLoginProfile

Input

Parameter	Description
userName	Name of the user you want to delete the password for
policyArn	Amazon Resource Name (ARN) of the policy to detach
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The user userName34 login profile has been deleted.

19. Delete a group

Delete a group from the Amazon IAM system.

Command Example

!aws-iam-delete-group groupName=Group123

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteGroup

Input

Parameter	Description
groupName	Name of the IAM group to delete
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The group Group123 has been deleted.

20. Remove a user from a group

Remove a user from a group in the Amazon IAM system.

Command Example

!aws-iam-remove-user-from-group userName=userName34 groupName=Group123

AWS IAM Policy Permission

Effect: Allow
Action: iam:RemoveUserFromGroup

Input

Parameter	Description
userName	Name of the user to remove from a group
groupName	Name of the IAM group to update (remove the user from)
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The user userName34 has been removed from group Group123.

21. Create a password for a user

Create a password for an IAM user in the Amazon IAM system.

Command Example

!aws-iam-create-login-profile userName=userName34 password=Avd#sdf$12VB6*cvg passwordResetRequired=True

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateLoginProfile

Input

Parameter	Description
userName	Name of the user to remove from a group
password	New password for the IAM user
passwordResetRequired	Specifies whether the user is required to set a new password on next sign in.
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

Login profile was created for user userName34.

22. Delete an access key

Create a password for an IAM user in the Amazon IAM system.

Command Example

!aws-iam-delete-access-key userName=userName34 AccessKeyId=AKIAJUAKDJQ7E7X5PADN7Y2D2A

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteAccessKey

Input

Parameter	Description
userName	Name of the user to remove from a group
AccessKeyId	Access key ID for the access key to delete
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The Access Key was deleted.

23. Create an instance profile

Creates an instance profile in the Amazon IAM system.

Command Example

!aws-iam-create-instance-profile instanceProfileName=testprofile path=/test/

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateInstanceProfile

Input

Parameter	Description
instanceProfileName	Name of the instance profile to create
path	Path to the instance profile
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Path	Path to the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileName	Name identifying the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileId	Stable and unique string identifying the instance profile
AWS.IAM.InstanceProfiles.Arn	Amazon Resource Name (ARN) specifying the instance profile
AWS.IAM.InstanceProfiles.CreateDate	Instance profile creation date

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:instance-profile/test/testprofile",
   "CreateDate":"2018-06-05T07:30:15",
   "InstanceProfileId":"/test/",
   "InstanceProfileName":"testprofile",
   "Path":"/test/"
}

24. Delete an instance profile

Deletes an instance profile from the Amazon IAM system.

Command Example

!aws-iam-delete-instance-profile instanceProfileName=testprofile

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteInstanceProfile

Input

Parameter	Description
instanceProfileName	Name of the instance profile to delete
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The InstanceProfile: testprofile was deleted.

25. List all instance profiles

Lists all instance profile in the Amazon IAM system.

Command Example

!aws-iam-list-instance-profiles

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListInstanceProfiles

Input

Parameter	Description
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Path	Path to the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileName	Name identifying the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileId	Stable and unique string identifying the instance profile
AWS.IAM.InstanceProfiles.Arn	Amazon Resource Name (ARN) specifying the instance profile
AWS.IAM.InstanceProfiles.CreateDate	Instance profile creation date
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:instance-profile/EC2ReadOnly",
      "CreateDate":"2018-05-11T11:27:55",
      "InstanceProfileId":"AIPAAFDFAJ5JLPIFSAFJC6VF6RX5Y",
      "InstanceProfileName":"EC2ReadOnly",
      "Path":"/",
      "RoleArn":"arn:aws:iam::123456789:role/EC2ReadOnly",
      "RoleId":"AR234OAIMZD2SAFWAKKUZK2QMR6",
      "RoleName":"EC2ReadOnly"
   },
   {  
      "Arn":"arn:aws:iam::123456789:instance-profile/SystemsManagerEC2Role",
      "CreateDate":"2018-05-01T14:35:28",
      "InstanceProfileId":"AIPSAFAJN4P5VISFaPFZETEOXOE",
      "InstanceProfileName":"SystemsManagerEC2Role",
      "Path":"/",
      "RoleArn":"arn:aws:iam::123456789:role/SystemsManagerEC2Role",
      "RoleId":"AROAJDLFEISFAZK5MP4DSDFYVE4",
      "RoleName":"SystemsManagerEC2Role"
   }
]

26. Add a role to an instance profile

Adds a role to an instance profile in the Amazon IAM system.

Command Example

!aws-iam-add-role-to-instance-profile instanceProfileName=testprofile roleName=EC2ReadOnly

AWS IAM Policy Permission

Effect: Allow
Action: iam:AddRoleToInstanceProfile

Input

Parameter	Description
instanceProfileName	Name of the instance profile to update
roleName	Name of the role to add
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Path	Path to the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileName	Name identifying the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileId	Stable and unique string identifying the instance profile
AWS.IAM.InstanceProfiles.Arn	Amazon Resource Name (ARN) specifying the instance profile
AWS.IAM.InstanceProfiles.CreateDate	Instance profile creation date
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

The Role: EC2ReadOnly was added to the Instance Profile: testprofile

27. Remove a role from an instance profile

Adds a role to an instance profile in the Amazon IAM system.

Command Example

!aws-iam-remove-role-from-instance-profile instanceProfileName=testprofile roleName=EC2ReadOnly

AWS IAM Policy Permission

Effect: Allow
Action: iam:RemoveRoleFromInstanceProfile

Input

Parameter	Description
instanceProfileName	Name of the instance profile to update
roleName	Name of the role to remove
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The Role: EC2ReadOnly was added to the Instance Profile: testprofile

28. List all instance profiles for a role

Lists all instance profile in the Amazon IAM system.

Command Example

!aws-iam-list-instance-profiles-for-role roleName=EC2ReadOnly

AWS IAM Policy Permission

Effect: Allow
Action: iam:ListInstanceProfilesForRole

Input

Parameter	Description
roleName	Name of the role to list instance profiles for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Path	Path to the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileName	Name identifying the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileId	Stable and unique string identifying the instance profile
AWS.IAM.InstanceProfiles.Arn	Amazon Resource Name (ARN) specifying the instance profile
AWS.IAM.InstanceProfiles.CreateDate	Instance profile creation date
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

[  
   {  
      "Arn":"arn:aws:iam::123456789:instance-profile/EC2ReadOnly",
      "CreateDate":"2018-05-11T11:27:55",
      "InstanceProfileId":"AIPAJAF5JLPIFDSAFJC6VF6RX5Y",
      "InstanceProfileName":"EC2ReadOnly",
      "Path":"/"
   },
   {  
      "Arn":"arn:aws:iam::123456789:instance-profile/test/testprofile",
      "CreateDate":"2018-06-05T07:35:28",
      "InstanceProfileId":"AIPAJRSDFQMQHSDF5CVUZSGMV76",
      "InstanceProfileName":"testprofile",
      "Path":"/test/"
   }
]

29. Get instance profile information

Returns profile information for an instance in the Amazon IAM system.

Command Example

!aws-iam-get-instance-profile instanceProfileName=testprofile

AWS IAM Policy Permission

Effect: Allow
Action: iam:GetInstanceProfile

Input

Parameter	Description
instanceProfileName	Name of the role to list instance profiles for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Path	Path to the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileName	Name identifying the instance profile
AWS.IAM.InstanceProfiles.InstanceProfileId	Stable and unique string identifying the instance profile
AWS.IAM.InstanceProfiles.Arn	Amazon Resource Name (ARN) specifying the instance profile
AWS.IAM.InstanceProfiles.CreateDate	Instance profile creation date
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:instance-profile/test/testprofile",
   "CreateDate":"2018-06-05T07:35:28",
   "InstanceProfileId":"AIPAJRASDFQMQH5ASFCVUZSGMV76",
   "InstanceProfileName":"testprofile",
   "Path":"/test/",
   "RoleArn":"arn:aws:iam::123456789:role/EC2ReadOnly",
   "RoleId":"AROAASFIMZD2WAKSAFKUZK2QMR6",
   "RoleName":"EC2ReadOnly"
}

30. Get role information

Returns information for a role in the Amazon IAM system.

Command Example

!aws-iam-get-role roleName=ec2readonly

AWS IAM Policy Permission

Effect: Allow
Action: iam:GetRole

Input

Parameter	Description
roleName	Name of the role to return information for
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:role/EC2ReadOnly",
   "CreateDate":"2018-05-11T11:27:55",
   "Path":"/",
   "RoleId":"AROAISAFMZD2WAKKUSFZK2QMR6",
   "RoleName":"EC2ReadOnly"
}

31. Delete a role

Returns information for a role in the Amazon IAM system.

Command Example

!aws-iam-delete-role roleName=test-role

AWS IAM Policy Permission

Effect: Allow
Action: iam:DeleteRole

Input

Parameter	Description
roleName	Name of the role to delete
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

There is no context output for this command.

Raw Output

The Role: test-role was deleted.

32. Create a role

Create a role in the Amazon IAM system.

Command Example

!aws-iam-create-role roleName=testrole assumeRolePolicyDocument="{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}" description="a test role"

AWS IAM Policy Permission

Effect: Allow
Action: iam:CreateRole

Input

Parameter	Description
roleName	Name of the role to create
assumeRolePolicyDocumentName	Trust relationship policy document that grants an entity permission to assume the role
path	Path to the role
description	Description of the role
maxSessionDuration	The maximum session duration (in hours) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum is one hour. Valid parameter values: 1 hour to 12 hours.
roleArn	Amazon Resource Name (ARN) of the role to assume
roleSessionName	Identifier for the assumed role session
roleSessionDuration	Duration of the role session, in seconds (the value can range from 900 seconds to the maximum session duration set for the role)

Context Output

Path	Description
AWS.IAM.InstanceProfiles.Roles.Path	Path to the role
AWS.IAM.InstanceProfiles.Roles.RoleName	Friendly name that identifies the role
AWS.IAM.InstanceProfiles.Roles.RoleId	Stable and unique string identifying the role
AWS.IAM.InstanceProfiles.Roles.Arn	Amazon Resource Name (ARN) specifying the role
AWS.IAM.InstanceProfiles.Roles.CreateDate	Role creation date and time
AWS.IAM.InstanceProfiles.Roles.AssumeRolePolicyDocument	Policy that grants an entity permission to assume the role
AWS.IAM.InstanceProfiles.Roles.Description	Description of the role
AWS.IAM.InstanceProfiles.Roles.MaxSessionDuration	Maximum session duration (in seconds) for the specified role

Raw Output

{  
   "Arn":"arn:aws:iam::123456789:role/test-role",
   "Path":"/",
   "RoleId":"ARsdOAJGHGQNWTADXZ2TT3DKY",
   "RoleName":"test-role"
}

33. Create a policy

Creates a new managed policy for your AWS account. This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version.

Base Command

aws-iam-create-policy

Input

Argument Name	Description	Required
policyName	The friendly name of the policy.	Required
policyDocument	The JSON policy document that you want to use as the content for the new policy.	Required
path	The path for the policy.	Optional
description	A friendly description of the policy.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Policies.PolicyName	string	The friendly name (not ARN) identifying the policy.
AWS.IAM.Policies.PolicyId	string	The stable and unique string identifying the policy.
AWS.IAM.Policies.Arn	string	The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
AWS.IAM.Policies.Path	string	The path to the policy.
AWS.IAM.Policies.DefaultVersionId	string	The identifier for the version of the policy that is set as the default version.
AWS.IAM.Policies.AttachmentCount	number	The number of entities (users, groups, and roles) that the policy is attached to.
AWS.IAM.Policies.PermissionsBoundaryUsageCount	number	The number of entities (users and roles) for which the policy is used to set the permissions boundary.
AWS.IAM.Policies.IsAttachable	boolean	Specifies whether the policy can be attached to an IAM user, group, or role.
AWS.IAM.Policies.Description	string	A friendly description of the policy.
AWS.IAM.Policies.CreateDate	date	Date and time the policy was created, in ISO 8601 date-time format
AWS.IAM.Policies.UpdateDate	date	Date and time the policy was updated, in ISO 8601 date-time format

Command Example

!aws-iam-create-policy policyName=test-policy policyDocument="{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "guardduty:CreateIPSet",
"Resource": "arn:aws:guardduty:::detector/"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "guardduty:CreateDetector",
"Resource": ""
}
]
}"

Context Example

Human Readable Output

34. Delete a policy

Deletes the specified managed policy. Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to. In addition you must delete all the policy's versions.

Base Command

aws-iam-delete-policy

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy you want to delete.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-policy policyArn=arn:aws:iam::123456789:policy/test-policy

Human Readable Output

35. Create a new version of a policy

Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version. Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached.

Base Command

aws-iam-create-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version.	Required
policyDocument	The JSON policy document that you want to use as the content for this new version of the policy.	Required
setAsDefault	Specifies whether to set this version as the policy's default version.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.IAM.Policies.Versions.Document	string	The policy document.
AWS.IAM.Policies.Versions.VersionId	string	The identifier for the policy version.
AWS.IAM.Policies.Versions.IsDefaultVersion	string	The identifier for the policy version.
AWS.IAM.Policies.Versions.CreateDate	string	Date and time the policy version was created, in ISO 8601 date-time format

Command Example

!aws-iam-create-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy policyDocument="{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "guardduty:CreateIPSet",
"Resource": "arn:aws:guardduty:::detector/"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "guardduty:CreateDetector",
"Resource": ""
}
]
}" setAsDefault=True

Context Example

Human Readable Output

36. Delete a policy version

Deletes the specified version from the specified managed policy. You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy . To find out which version of a policy is marked as the default version, use ListPolicyVersions .

Base Command

aws-iam-delete-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy from which you want to delete a version.	Required
versionId	The policy version to delete.	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v1

Human Readable Output

37. Get information for all versions of a policy

Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.

Base Command

aws-iam-list-policy-versions

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.	Required

Context Output

Path	Type	Description
AWS.IAM.Policies.Versions.Document	string	The policy document
AWS.IAM.Policies.Versions.VersionId	string	The identifier for the policy version
AWS.IAM.Policies.Versions.IsDefaultVersion	boolean	Specifies whether the policy version is set as the policy's default version
AWS.IAM.Policies.Versions.CreateDate	date	Date and time the policy version was created, in ISO 8601 date-time format

Command Example

!aws-iam-list-policy-versions policyArn=arn:aws:iam::123456789:policy/test-policy

Context Example

Human Readable Output

38. Get information for a policy version

Retrieves information about the specified version of the specified managed policy, including the policy document.

Base Command

aws-iam-get-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the managed policy that you want information about	Required
versionId	Identifies the policy version to retrieve	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Description
AWS.IAM.Policies.Versions.Document	The policy document
AWS.IAM.Policies.Versions.VersionId	The identifier for the policy version
AWS.IAM.Policies.Versions.IsDefaultVersion	Specifies whether the policy version is set as the policy's default version
AWS.IAM.Policies.Versions.CreateDate	Date and time the policy version was created, in ISO 8601 date-time format

Command Example

!aws-iam-get-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v3

Context Example

Human Readable Output

39. Set a default (operative) policy version

Sets the specified version of the specified policy as the policy's default (operative) version. This operation affects all users, groups, and roles that the policy is attached to.

Base Command

aws-iam-set-default-policy-version

Input

Argument Name	Description	Required
policyArn	The Amazon Resource Name (ARN) of the IAM policy whose default version you want to set	Required
versionId	The version of the policy to set as the default (operative) version	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume	Optional
roleSessionName	An identifier for the assumed role session	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-set-default-policy-version policyArn=arn:aws:iam::123456789:policy/test-policy versionId=v2

Human Readable Output

40. Create an account alias

Creates an alias for your AWS account.

Base Command

aws-iam-create-account-alias

Input

Argument Name	Description	Required
accountAlias	The account alias to create	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume	Optional
roleSessionName	An identifier for the assumed role session	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-create-account-alias accountAlias=test-alias

Human Readable Output

41. Delete an account alias

Deletes the specified AWS account alias.

Base Command

aws-iam-delete-account-alias

Input

Argument Name	Description	Required
accountAlias	The name of the account alias to delete	Required
roleArn	The Amazon Resource Name (ARN) of the role to assume	Optional
roleSessionName	An identifier for the assumed role session	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role	Optional

Context Output

There is no context output for this command.

Command Example

!aws-iam-delete-account-alias accountAlias=demisto-test-alias

PAN-OS

Cortex Data Lake

Cortex XSOAR

PAN-OS

Cortex Data Lake

Cortex XSOAR

Prerequisites

Configure the AWS IAM Integration on Demisto

Commands

1. Create a user

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

2. Get user information

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

3. Get a list of users

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

4. Update user information

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

5. Delete a user

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

6. Update a user's password

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

7. Create a group

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

8. Get a list of groups

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

9. List all groups a user is part of

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

10. Add a user to a group

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

11. Create an access key

Command Example

AWS IAM Policy Permission

Input

Context Output

Raw Output

12. Update an access key

Command Example

AWS IAM Policy Permission

Input

Context Output