iam

class pulumi_aws.iam.AccessKey(resource_name, opts=None, pgp_key=None, status=None, user=None, __name__=None, __opts__=None)

Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.
  • status (pulumi.Input[str]) – The access key status to apply. Defaults to Active. Valid values are Active and Inactive.
  • user (pulumi.Input[str]) – The IAM user to associate with this access key.
encrypted_secret = None

The encrypted secret, base64 encoded.

NOTE: The encrypted secret may be decrypted using the command line, for example: terraform output encrypted_secret | base64 --decode | keybase pgp decrypt.
key_fingerprint = None

The fingerprint of the PGP key used to encrypt the secret

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:some_person_that_exists.

secret = None

The secret access key. Note that this will be written to the state file. Please supply a pgp_key instead, which will prevent the secret from being stored in plain text

ses_smtp_password = None

The secret access key converted into an SES SMTP password by applying AWS’s documented conversion algorithm.

status = None

The access key status to apply. Defaults to Active. Valid values are Active and Inactive.

user = None

The IAM user to associate with this access key.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.AccountAlias(resource_name, opts=None, account_alias=None, __name__=None, __opts__=None)
Note: There is only a single account alias per AWS account.

Manages the account alias for the AWS Account.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • account_alias (pulumi.Input[str]) – The account alias
account_alias = None

The account alias

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.AccountPasswordPolicy(resource_name, opts=None, allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, __name__=None, __opts__=None)
Note: There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.

Manages Password Policy for the AWS Account. See more about Account Password Policy in the official AWS docs.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • allow_users_to_change_password (pulumi.Input[bool]) – Whether to allow users to change their own password
  • hard_expiry (pulumi.Input[bool]) – Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)
  • max_password_age (pulumi.Input[float]) – The number of days that an user password is valid.
  • minimum_password_length (pulumi.Input[float]) – Minimum length to require for user passwords.
  • password_reuse_prevention (pulumi.Input[float]) – The number of previous passwords that users are prevented from reusing.
  • require_lowercase_characters (pulumi.Input[bool]) – Whether to require lowercase characters for user passwords.
  • require_numbers (pulumi.Input[bool]) – Whether to require numbers for user passwords.
  • require_symbols (pulumi.Input[bool]) – Whether to require symbols for user passwords.
  • require_uppercase_characters (pulumi.Input[bool]) – Whether to require uppercase characters for user passwords.
allow_users_to_change_password = None

Whether to allow users to change their own password

expire_passwords = None

Indicates whether passwords in the account expire. Returns true if max_password_age contains a value greater than 0. Returns false if it is 0 or not present.

hard_expiry = None

Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset)

max_password_age = None

The number of days that an user password is valid.

minimum_password_length = None

Minimum length to require for user passwords.

password_reuse_prevention = None

The number of previous passwords that users are prevented from reusing.

require_lowercase_characters = None

Whether to require lowercase characters for user passwords.

require_numbers = None

Whether to require numbers for user passwords.

require_symbols = None

Whether to require symbols for user passwords.

require_uppercase_characters = None

Whether to require uppercase characters for user passwords.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GetAccountAliasResult(account_alias=None, id=None)

A collection of values returned by getAccountAlias.

account_alias = None

The alias associated with the AWS account.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetGroupResult(arn=None, group_id=None, group_name=None, path=None, id=None)

A collection of values returned by getGroup.

arn = None

The Amazon Resource Name (ARN) specifying the group.

group_id = None

The stable and unique string identifying the group.

path = None

The path to the group.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetInstanceProfileResult(arn=None, create_date=None, name=None, path=None, role_arn=None, role_id=None, role_name=None, id=None)

A collection of values returned by getInstanceProfile.

arn = None

The Amazon Resource Name (ARN) specifying the instance profile.

create_date = None

The string representation of the date the instance profile was created.

path = None

The path to the instance profile.

role_arn = None

The role arn associated with this instance profile.

role_id = None

The role id associated with this instance profile.

role_name = None

The role name associated with this instance profile.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyDocumentResult(json=None, override_json=None, policy_id=None, source_json=None, statements=None, version=None, id=None)

A collection of values returned by getPolicyDocument.

json = None

The above arguments serialized as a standard JSON policy document.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetPolicyResult(arn=None, description=None, name=None, path=None, policy=None, id=None)

A collection of values returned by getPolicy.

arn = None

The Amazon Resource Name (ARN) specifying the policy.

description = None

The description of the policy.

name = None

The name of the IAM policy.

path = None

The path to the policy.

policy = None

The policy document of the policy.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetRoleResult(arn=None, assume_role_policy=None, create_date=None, description=None, max_session_duration=None, name=None, path=None, permissions_boundary=None, unique_id=None, id=None)

A collection of values returned by getRole.

arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy document associated with the role.

create_date = None

Creation date of the role in RFC 3339 format.

description = None

Description for the role.

max_session_duration = None

Maximum session duration.

path = None

The path to the role.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

unique_id = None

The stable and unique string identifying the role.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetServerCertificateResult(arn=None, certificate_body=None, certificate_chain=None, expiration_date=None, latest=None, name=None, name_prefix=None, path=None, path_prefix=None, upload_date=None, id=None)

A collection of values returned by getServerCertificate.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.GetUserResult(arn=None, path=None, permissions_boundary=None, user_id=None, user_name=None, id=None)

A collection of values returned by getUser.

arn = None

The Amazon Resource Name (ARN) assigned by AWS for this user.

path = None

Path in which this user was created.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

user_id = None

The unique ID assigned by AWS for this user.

user_name = None

The name associated to this User

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_aws.iam.Group(resource_name, opts=None, name=None, path=None, __name__=None, __opts__=None)

Provides an IAM group.

Parameters:
  • resource*name (str) –

    The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-*.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.
  • path (pulumi.Input[str]) – Path in which to create the group.
arn = None

The ARN assigned by AWS for this group.

name = None

The group’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. Group names are not distinguished by case. For example, you cannot create groups named both “ADMINS” and “admins”.

path = None

Path in which to create the group.

unique_id = None

The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupMembership(resource_name, opts=None, group=None, name=None, users=None, __name__=None, __opts__=None)
WARNING: Multiple aws_iam_group_membership resources with the same group name will produce inconsistent behavior!

Provides a top level resource to manage IAM Group membership for IAM Users. For more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or [IAM Users][2]

Note: aws_iam_group_membership will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the [aws_iam_user_group_membership resource][3].
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The IAM Group name to attach the list of users to
  • name (pulumi.Input[str]) – The name to identify the Group Membership
  • users (pulumi.Input[list]) – A list of IAM User names to associate with the Group
group = None

The IAM Group name to attach the list of users to

name = None

The name to identify the Group Membership

users = None

A list of IAM User names to associate with the Group

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupPolicy(resource_name, opts=None, group=None, name=None, name_prefix=None, policy=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a group.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The IAM group to attach to the policy.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) – The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the AWS IAM Policy Document Guide
group = None

The IAM group to attach to the policy.

name = None

The name of the policy. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the AWS IAM Policy Document Guide

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.GroupPolicyAttachment(resource_name, opts=None, group=None, policy_arn=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM group

NOTE: The usage of this resource conflicts with the aws_iam_policy_attachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • group (pulumi.Input[str]) – The group the policy should be applied to
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
group = None

The group the policy should be applied to

policy_arn = None

The ARN of the policy you want to apply

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.InstanceProfile(resource_name, opts=None, name=None, name_prefix=None, path=None, role=None, roles=None, __name__=None, __opts__=None)

Provides an IAM instance profile.

NOTE: Either role or roles (deprecated) must be specified.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The profile’s name. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – Path in which to create the profile.
  • role (pulumi.Input[str]) – The role name to include in the profile.
  • roles (pulumi.Input[list]) – A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase. WARNING: This is deprecated since version 0.9.3 (April 12, 2017), as >= 2 roles are not possible. See issue #11575.
arn = None

The ARN assigned by AWS to the instance profile.

create_date = None

The creation timestamp of the instance profile.

name = None

The profile’s name. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the profile.

role = None

The role name to include in the profile.

roles = None

A list of role names to include in the profile. The current default is 1. If you see an error message similar to Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1, then you must contact AWS support and ask for a limit increase. WARNING: This is deprecated since version 0.9.3 (April 12, 2017), as >= 2 roles are not possible. See issue #11575.

unique_id = None

The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.OpenIdConnectProvider(resource_name, opts=None, client_id_lists=None, thumbprint_lists=None, url=None, __name__=None, __opts__=None)

Provides an IAM OpenID Connect provider.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • client_id_lists (pulumi.Input[list]) – A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)
  • thumbprint_lists (pulumi.Input[list]) – A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).
  • url (pulumi.Input[str]) – The URL of the identity provider. Corresponds to the iss claim.
arn = None

The ARN assigned by AWS for this provider.

client_id_lists = None

A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that’s sent as the client_id parameter on OAuth requests.)

thumbprint_lists = None

A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider’s server certificate(s).

url = None

The URL of the identity provider. Corresponds to the iss claim.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.Policy(resource_name, opts=None, description=None, name=None, name_prefix=None, path=None, policy=None, __name__=None, __opts__=None)

Provides an IAM policy.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • description (pulumi.Input[str]) – Description of the IAM policy.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – Path in which to create the policy. See IAM Identifiers for more information.
  • policy (pulumi.Input[str]) –

    The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide

arn = None

The ARN assigned by AWS to this policy.

description = None

Description of the IAM policy.

name = None

The name of the policy. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

Path in which to create the policy. See IAM Identifiers for more information.

policy = None

The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.PolicyAttachment(resource_name, opts=None, groups=None, name=None, policy_arn=None, roles=None, users=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)

!> WARNING: The aws_iam_policy_attachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws_iam_policy_attachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead. These resources do not enforce exclusive attachment of an IAM policy.

NOTE: The usage of this resource conflicts with the aws_iam_group_policy_attachment, aws_iam_role_policy_attachment, and aws_iam_user_policy_attachment resources and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • groups (pulumi.Input[list]) – The group(s) the policy should be applied to
  • name (pulumi.Input[str]) – The name of the attachment. This cannot be an empty string.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • roles (pulumi.Input[list]) – The role(s) the policy should be applied to
  • users (pulumi.Input[list]) – The user(s) the policy should be applied to
groups = None

The group(s) the policy should be applied to

name = None

The name of the attachment. This cannot be an empty string.

policy_arn = None

The ARN of the policy you want to apply

roles = None

The role(s) the policy should be applied to

users = None

The user(s) the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.Role(resource_name, opts=None, assume_role_policy=None, description=None, force_detach_policies=None, max_session_duration=None, name=None, name_prefix=None, path=None, permissions_boundary=None, tags=None, __name__=None, __opts__=None)

Provides an IAM role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • assume_role_policy (pulumi.Input[str]) – The policy that grants an entity permission to assume the role.
  • description (pulumi.Input[str]) – The description of the role.
  • force_detach_policies (pulumi.Input[bool]) – Specifies to force detaching any policies the role has before destroying it. Defaults to false.
  • max_session_duration (pulumi.Input[float]) – The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
  • name (pulumi.Input[str]) – The name of the role. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) –

    The path to the role. See IAM Identifiers for more information.

  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the role.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM role
arn = None

The Amazon Resource Name (ARN) specifying the role.

assume_role_policy = None

The policy that grants an entity permission to assume the role.

create_date = None

The creation date of the IAM role.

description = None

The description of the role.

force_detach_policies = None

Specifies to force detaching any policies the role has before destroying it. Defaults to false.

max_session_duration = None

The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.

name = None

The name of the role. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The path to the role. See IAM Identifiers for more information.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the role.

tags = None

Key-value mapping of tags for the IAM role

unique_id = None

The stable and unique string identifying the role.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.RolePolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, role=None, __name__=None, __opts__=None)

Provides an IAM role policy.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the role policy. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) –

    The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the AWS IAM Policy Document Guide

  • role (pulumi.Input[str]) – The IAM role to attach to the policy.
name = None

The name of the role policy. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the AWS IAM Policy Document Guide

role = None

The IAM role to attach to the policy.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.RolePolicyAttachment(resource_name, opts=None, policy_arn=None, role=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM role

NOTE: The usage of this resource conflicts with the aws_iam_policy_attachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • role (pulumi.Input[str]) – The role the policy should be applied to
policy_arn = None

The ARN of the policy you want to apply

role = None

The role the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.SamlProvider(resource_name, opts=None, name=None, saml_metadata_document=None, __name__=None, __opts__=None)

Provides an IAM SAML provider.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the provider to create.
  • saml_metadata_document (pulumi.Input[str]) – An XML document generated by an identity provider that supports SAML 2.0.
arn = None

The ARN assigned by AWS for this provider.

name = None

The name of the provider to create.

saml_metadata_document = None

An XML document generated by an identity provider that supports SAML 2.0.

valid_until = None

The expiration date and time for the SAML provider in RFC1123 format, e.g. Mon, 02 Jan 2006 15:04:05 MST.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.ServerCertificate(resource_name, opts=None, arn=None, certificate_body=None, certificate_chain=None, name=None, name_prefix=None, path=None, private_key=None, __name__=None, __opts__=None)

Provides an IAM Server Certificate resource to upload Server Certificates. Certs uploaded to IAM can easily work with other AWS services such as:

  • AWS Elastic Beanstalk
  • Elastic Load Balancing
  • CloudFront
  • AWS OpsWorks

For information about server certificates in IAM, see [Managing Server Certificates][2] in AWS Documentation.

Note: All arguments including the private key will be stored in the raw state as plain-text. Read more about sensitive data in state.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • arn (pulumi.Input[str]) – The Amazon Resource Name (ARN) specifying the server certificate.
  • certificate_body (pulumi.Input[str]) – The contents of the public key certificate in PEM-encoded format.
  • certificate_chain (pulumi.Input[str]) – The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.
  • name (pulumi.Input[str]) – The name of the Server Certificate. Do not include the path in this value. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • path (pulumi.Input[str]) – The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.
  • private_key (pulumi.Input[str]) – The contents of the private key in PEM-encoded format.
arn = None

The Amazon Resource Name (ARN) specifying the server certificate.

certificate_body = None

The contents of the public key certificate in PEM-encoded format.

certificate_chain = None

The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

name = None

The name of the Server Certificate. Do not include the path in this value. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

path = None

The IAM path for the server certificate. If it is not included, it defaults to a slash (/). If this certificate is for use with AWS CloudFront, the path must be in format /cloudfront/your_path_here. See [IAM Identifiers][1] for more details on IAM Paths.

private_key = None

The contents of the private key in PEM-encoded format.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.ServiceLinkedRole(resource_name, opts=None, aws_service_name=None, custom_suffix=None, description=None, __name__=None, __opts__=None)

Provides an IAM service-linked role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • aws_service_name (pulumi.Input[str]) – The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.
  • custom_suffix (pulumi.Input[str]) – Additional string appended to the role name. Not all AWS services support custom suffixes.
  • description (pulumi.Input[str]) – The description of the role.
arn = None

The Amazon Resource Name (ARN) specifying the role.

aws_service_name = None

The AWS service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com. To find the full list of services that support service-linked roles, check the docs.

create_date = None

The creation date of the IAM role.

custom_suffix = None

Additional string appended to the role name. Not all AWS services support custom suffixes.

description = None

The description of the role.

name = None

The name of the role.

path = None

The path of the role.

unique_id = None

The stable and unique string identifying the role.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.SshKey(resource_name, opts=None, encoding=None, public_key=None, status=None, username=None, __name__=None, __opts__=None)

Uploads an SSH public key and associates it with the specified IAM user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • encoding (pulumi.Input[str]) – Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.
  • public_key (pulumi.Input[str]) – The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.
  • status (pulumi.Input[str]) – The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.
  • username (pulumi.Input[str]) – The name of the IAM user to associate the SSH public key with.
encoding = None

Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.

fingerprint = None

The MD5 message digest of the SSH public key.

public_key = None

The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.

ssh_public_key_id = None

The unique identifier for the SSH public key.

status = None

The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is active.

username = None

The name of the IAM user to associate the SSH public key with.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.User(resource_name, opts=None, force_destroy=None, name=None, path=None, permissions_boundary=None, tags=None, __name__=None, __opts__=None)

Provides an IAM user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • force_destroy (pulumi.Input[bool]) – When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed.
  • name (pulumi.Input[str]) – The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.
  • path (pulumi.Input[str]) – Path in which to create the user.
  • permissions_boundary (pulumi.Input[str]) – The ARN of the policy that is used to set the permissions boundary for the user.
  • tags (pulumi.Input[dict]) – Key-value mapping of tags for the IAM user
arn = None

The ARN assigned by AWS for this user.

force_destroy = None

When destroying this user, destroy even if it has non-Terraform-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-Terraform-managed access keys and login profile will fail to be destroyed.

name = None

The user’s name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both “TESTUSER” and “testuser”.

path = None

Path in which to create the user.

permissions_boundary = None

The ARN of the policy that is used to set the permissions boundary for the user.

tags = None

Key-value mapping of tags for the IAM user

unique_id = None

The [unique ID][1] assigned by AWS.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserGroupMembership(resource_name, opts=None, groups=None, user=None, __name__=None, __opts__=None)

Provides a resource for adding an [IAM User][2] to [IAM Groups][1]. This resource can be used multiple times with the same user for non-overlapping groups.

To exclusively manage the users in a group, see the [aws_iam_group_membership resource][3].

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • groups (pulumi.Input[list]) – A list of [IAM Groups][1] to add the user to
  • user (pulumi.Input[str]) – The name of the [IAM User][2] to add to groups
groups = None

A list of [IAM Groups][1] to add the user to

user = None

The name of the [IAM User][2] to add to groups

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserLoginProfile(resource_name, opts=None, password_length=None, password_reset_required=None, pgp_key=None, user=None, __name__=None, __opts__=None)

Manages an IAM User Login Profile with limited support for password creation during Terraform resource creation. Uses PGP to encrypt the password for safe transport to the user. PGP keys can be obtained from Keybase.

To reset an IAM User login password via Terraform, you can use the ``terraform taint` command <https://www.terraform.io/docs/commands/taint.html>`_ or change any of the arguments.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • password_length (pulumi.Input[float]) – The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.
  • password_reset_required (pulumi.Input[bool]) – Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.
  • pgp_key (pulumi.Input[str]) – Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.
  • user (pulumi.Input[str]) – The IAM user’s name.
encrypted_password = None

The encrypted password, base64 encoded. Only available if password was handled on Terraform resource creation, not import.

key_fingerprint = None

The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on Terraform resource creation, not import.

password_length = None

The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

password_reset_required = None

Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument.

pgp_key = None

Either a base-64 encoded PGP public key, or a keybase username in the form keybase:username. Only applies on resource creation. Drift detection is not possible with this argument.

user = None

The IAM user’s name.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserPolicy(resource_name, opts=None, name=None, name_prefix=None, policy=None, user=None, __name__=None, __opts__=None)

Provides an IAM policy attached to a user.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • name (pulumi.Input[str]) – The name of the policy. If omitted, Terraform will assign a random, unique name.
  • name_prefix (pulumi.Input[str]) – Creates a unique name beginning with the specified prefix. Conflicts with name.
  • policy (pulumi.Input[str]) –

    The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide.

  • user (pulumi.Input[str]) – IAM user to which to attach this policy.
name = None

The name of the policy. If omitted, Terraform will assign a random, unique name.

name_prefix = None

Creates a unique name beginning with the specified prefix. Conflicts with name.

policy = None

The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide.

user = None

IAM user to which to attach this policy.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_aws.iam.UserPolicyAttachment(resource_name, opts=None, policy_arn=None, user=None, __name__=None, __opts__=None)

Attaches a Managed IAM Policy to an IAM user

NOTE: The usage of this resource conflicts with the aws_iam_policy_attachment resource and will permanently show a difference if both are defined.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • policy_arn (pulumi.Input[str]) – The ARN of the policy you want to apply
  • user (pulumi.Input[str]) – The user the policy should be applied to
policy_arn = None

The ARN of the policy you want to apply

user = None

The user the policy should be applied to

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
pulumi_aws.iam.get_account_alias(opts=None)

The IAM Account Alias data source allows access to the account alias for the effective account in which Terraform is working.

pulumi_aws.iam.get_group(group_name=None, opts=None)

This data source can be used to fetch information about a specific IAM group. By using this data source, you can reference IAM group properties without having to hard code ARNs as input.

pulumi_aws.iam.get_instance_profile(name=None, opts=None)

This data source can be used to fetch information about a specific IAM instance profile. By using this data source, you can reference IAM instance profile properties without having to hard code ARNs as input.

pulumi_aws.iam.get_policy(arn=None, opts=None)

This data source can be used to fetch information about a specific IAM policy.

pulumi_aws.iam.get_policy_document(override_json=None, policy_id=None, source_json=None, statements=None, version=None, opts=None)

Generates an IAM policy document in JSON format.

This is a data source which can be used to construct a JSON representation of an IAM policy document, for use with resources which expect policy documents, such as the aws_iam_policy resource.

For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide.

Using this data source to generate policy documents is optional. It is also valid to use literal JSON strings within your configuration, or to use the file interpolation function to read a raw JSON policy document from a file.

The IAM policy document format allows context variables to be interpolated into various strings within a statement. The native IAM policy document format uses ${...}-style syntax that is in conflict with Terraform’s interpolation syntax, so this data source instead uses &{...} syntax for interpolations that should be processed by AWS rather than by Terraform.

In order to define wildcard principal (a.k.a. anonymous user) use type = "*" and identifiers = ["*"]. In that case the rendered json will contain "Principal": "*". Note, that even though the IAM Documentation states that "Principal": "*" and "Principal": {"AWS": "*"} are equivalent, those principals have different behavior for IAM Role Trust Policy. Therefore Terraform will normalize the principal field only in above-mentioned case and principals like type = "AWS" and identifiers = ["*"] will be rendered as "Principal": {"AWS": "*"}.

pulumi_aws.iam.get_role(name=None, opts=None)

This data source can be used to fetch information about a specific IAM role. By using this data source, you can reference IAM role properties without having to hard code ARNs as input.

pulumi_aws.iam.get_server_certificate(latest=None, name=None, name_prefix=None, path_prefix=None, opts=None)

Use this data source to lookup information about IAM Server Certificates.

The terraform import function will read in certificate body, certificate chain (if it exists), id, name, path, and arn. It will not retrieve the private key which is not available through the AWS API.

pulumi_aws.iam.get_user(user_name=None, opts=None)

This data source can be used to fetch information about a specific IAM user. By using this data source, you can reference IAM user properties without having to hard code ARNs or unique IDs as input.