AWS.IAM reference

AccessKey

Source: src/AWS/IAM/AccessKey.ts

An IAM access key for a user.

AccessKey manages long-lived programmatic credentials for an IAM user. The secret access key is only returned during creation, so later reads preserve the originally stored redacted value instead of pretending AWS can return it again.

AccessKey: Managing Programmatic Credentials

const user = yield* User("DeployUser", {
  userName: "deploy-user",
});

const key = yield* AccessKey("DeployUserKey", {
  userName: user.userName,
  status: "Active",
});

AccountAlias

Source: src/AWS/IAM/AccountAlias.ts

The singleton IAM account alias for an AWS account.

AccountAlias manages the one account-level alias that customizes the AWS sign-in URL for the current account.

AccountAlias: Managing Account Identity

const alias = yield* AccountAlias("AccountAlias", {
  accountAlias: "my-company-prod",
});

AccountPasswordPolicy

Source: src/AWS/IAM/AccountPasswordPolicy.ts

The singleton IAM account password policy.

AccountPasswordPolicy manages the account-wide password requirements that apply to IAM users with console passwords.

AccountPasswordPolicy: Managing Password Rules

const policy = yield* AccountPasswordPolicy("PasswordPolicy", {
  MinimumPasswordLength: 16,
  RequireSymbols: true,
  RequireNumbers: true,
  RequireUppercaseCharacters: true,
  RequireLowercaseCharacters: true,
  AllowUsersToChangePassword: true,
});

GenerateCredentialReport

Source: src/AWS/IAM/GenerateCredentialReport.ts

Runtime binding for iam:GenerateCredentialReport — kick off generation of the account-wide credential report (per-user password/key/MFA hygiene as CSV). Pair with GetCredentialReport to retrieve the report once the returned State is COMPLETE.

Account-singleton operation: the binding takes no arguments and grants iam:GenerateCredentialReport on *. Provide the implementation with Effect.provide(AWS.IAM.GenerateCredentialReportHttp).

GenerateCredentialReport: Credential Reports

// init
const generateCredentialReport = yield* IAM.GenerateCredentialReport();

// runtime
const { State } = yield* generateCredentialReport();
// "STARTED" | "INPROGRESS" | "COMPLETE"

GenerateServiceLastAccessedDetails

Source: src/AWS/IAM/GenerateServiceLastAccessedDetails.ts

Runtime binding for iam:GenerateServiceLastAccessedDetails — start an access-advisor report for an IAM user, group, role, or policy, answering “which services has this entity actually used?”. Pair with GetServiceLastAccessedDetails to poll the returned JobId.

The target entity (Arn) is chosen per request — least-privilege tooling typically iterates entities discovered at runtime — so the binding takes no arguments and grants iam:GenerateServiceLastAccessedDetails on *. Provide the implementation with Effect.provide(AWS.IAM.GenerateServiceLastAccessedDetailsHttp).

GenerateServiceLastAccessedDetails: Access Advisor

// init
const generateServiceLastAccessedDetails =
  yield* IAM.GenerateServiceLastAccessedDetails();

// runtime
const { JobId } = yield* generateServiceLastAccessedDetails({
  Arn: roleArn,
});

GetAccessKeyLastUsed

Source: src/AWS/IAM/GetAccessKeyLastUsed.ts

Runtime binding for iam:GetAccessKeyLastUsed — read when (and against which service/region) a bound AccessKey last authenticated. The primitive behind key-rotation and stale-credential reapers.

Bind a canonical AccessKey; the runtime callable injects the key’s AccessKeyId. AWS scopes the action to the owning user, whose exact path-qualified ARN is not derivable from the key, so the grant is iam:GetAccessKeyLastUsed on *. Provide the implementation with Effect.provide(AWS.IAM.GetAccessKeyLastUsedHttp).

GetAccessKeyLastUsed: Access Key Hygiene

// init
const getAccessKeyLastUsed = yield* IAM.GetAccessKeyLastUsed(accessKey);

// runtime
const { AccessKeyLastUsed, UserName } = yield* getAccessKeyLastUsed();
const lastUsed = AccessKeyLastUsed?.LastUsedDate;

GetAccountAuthorizationDetails

Source: src/AWS/IAM/GetAccountAuthorizationDetails.ts

Runtime binding for iam:GetAccountAuthorizationDetails — snapshot every IAM user, group, role, and policy in the account together with their relationships. The single-call foundation for permission-graph analyzers and drift detectors.

Account-singleton operation: the binding takes no arguments and grants iam:GetAccountAuthorizationDetails on *. Provide the implementation with Effect.provide(AWS.IAM.GetAccountAuthorizationDetailsHttp).

GetAccountAuthorizationDetails: Account Auditing

// init
const getAuthorizationDetails = yield* IAM.GetAccountAuthorizationDetails();

// runtime — paginate with the Marker until IsTruncated is false
const page = yield* getAuthorizationDetails({
  Filter: ["Role"],
  MaxItems: 100,
});
const roles = page.RoleDetailList ?? [];

GetAccountSummary

Source: src/AWS/IAM/GetAccountSummary.ts

Runtime binding for iam:GetAccountSummary — read IAM entity usage and quota counters for the account (Users, Roles, PoliciesQuota, MFADevices, AccountMFAEnabled, …). The quick health snapshot behind quota alarms and security dashboards.

Account-singleton operation: the binding takes no arguments and grants iam:GetAccountSummary on *. Provide the implementation with Effect.provide(AWS.IAM.GetAccountSummaryHttp).

GetAccountSummary: Account Auditing

// init
const getAccountSummary = yield* IAM.GetAccountSummary();

// runtime
const { SummaryMap } = yield* getAccountSummary();
const nearQuota =
  (SummaryMap?.Roles ?? 0) > 0.9 * (SummaryMap?.RolesQuota ?? Infinity);

GetContextKeysForCustomPolicy

Source: src/AWS/IAM/GetContextKeysForCustomPolicy.ts

Runtime binding for iam:GetContextKeysForCustomPolicy — list the condition context keys (aws:username, aws:SourceIp, …) referenced by a set of candidate policy documents, so a simulation can be primed with the right ContextEntries.

The policies are supplied as strings per request, so the binding takes no arguments and grants iam:GetContextKeysForCustomPolicy on *. Provide the implementation with Effect.provide(AWS.IAM.GetContextKeysForCustomPolicyHttp).

GetContextKeysForCustomPolicy: Simulating Policies

// init
const getContextKeys = yield* IAM.GetContextKeysForCustomPolicy();

// runtime
const { ContextKeyNames } = yield* getContextKeys({
  PolicyInputList: [policyJson],
});

GetContextKeysForPrincipalPolicy

Source: src/AWS/IAM/GetContextKeysForPrincipalPolicy.ts

Runtime binding for iam:GetContextKeysForPrincipalPolicy — list the condition context keys referenced by all policies attached to an existing IAM user, group, or role, so a principal simulation can be primed with the right ContextEntries.

The principal (PolicySourceArn) is chosen per request, so the binding takes no arguments and grants iam:GetContextKeysForPrincipalPolicy on *. Provide the implementation with Effect.provide(AWS.IAM.GetContextKeysForPrincipalPolicyHttp).

GetContextKeysForPrincipalPolicy: Simulating Policies

// init
const getContextKeys = yield* IAM.GetContextKeysForPrincipalPolicy();

// runtime
const { ContextKeyNames } = yield* getContextKeys({
  PolicySourceArn: roleArn,
});

GetCredentialReport

Source: src/AWS/IAM/GetCredentialReport.ts

Runtime binding for iam:GetCredentialReport — download the account-wide credential report started by GenerateCredentialReport. The report is base64-encoded CSV of per-user credential hygiene (password age, key rotation, MFA status); it contains no secret material.

Retrieval before a report exists surfaces the typed CredentialReportNotPresentException / CredentialReportNotReadyException tags. Account-singleton operation: the binding takes no arguments and grants iam:GetCredentialReport on *. Provide the implementation with Effect.provide(AWS.IAM.GetCredentialReportHttp).

GetCredentialReport: Credential Reports

// init
const getCredentialReport = yield* IAM.GetCredentialReport();

// runtime
const report = yield* getCredentialReport().pipe(
  Effect.map((r) => new TextDecoder().decode(r.Content)),
  Effect.catchTag("CredentialReportNotPresentException", () =>
    Effect.succeed(undefined),
  ),
);

GetServiceLastAccessedDetails

Source: src/AWS/IAM/GetServiceLastAccessedDetails.ts

Runtime binding for iam:GetServiceLastAccessedDetails — poll and read the access-advisor report started by GenerateServiceLastAccessedDetails: job status plus, when COMPLETED, the per-service last-authenticated timeline for the entity.

The JobId is produced at runtime, so the binding takes no arguments and grants iam:GetServiceLastAccessedDetails on *. Provide the implementation with Effect.provide(AWS.IAM.GetServiceLastAccessedDetailsHttp).

GetServiceLastAccessedDetails: Access Advisor

// init
const getServiceLastAccessedDetails =
  yield* IAM.GetServiceLastAccessedDetails();

// runtime
const report = yield* getServiceLastAccessedDetails({ JobId: jobId });
if (report.JobStatus === "COMPLETED") {
  const unused = report.ServicesLastAccessed?.filter(
    (s) => s.LastAuthenticated === undefined,
  );
}

GetServiceLastAccessedDetailsWithEntities

Source: src/AWS/IAM/GetServiceLastAccessedDetailsWithEntities.ts

Runtime binding for iam:GetServiceLastAccessedDetailsWithEntities — after an access-advisor job generated for a group or policy, drill into which member users/roles actually attempted to use a given service namespace.

The JobId is produced at runtime, so the binding takes no arguments and grants iam:GetServiceLastAccessedDetailsWithEntities on *. Provide the implementation with Effect.provide(AWS.IAM.GetServiceLastAccessedDetailsWithEntitiesHttp).

GetServiceLastAccessedDetailsWithEntities: Access Advisor

// init
const getDetailsWithEntities =
  yield* IAM.GetServiceLastAccessedDetailsWithEntities();

// runtime
const { EntityDetailsList } = yield* getDetailsWithEntities({
  JobId: jobId,
  ServiceNamespace: "s3",
});

Group

Source: src/AWS/IAM/Group.ts

An IAM group that can own managed and inline policies.

Group manages a shared authorization container for IAM users, including attached managed policies and embedded inline policies.

Group: Creating IAM Groups

const group = yield* Group("SupportGroup", {
  groupName: "support",
  inlinePolicies: {
    SupportReadOnly: {
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: ["cloudwatch:Get*", "cloudwatch:List*"],
        Resource: ["*"],
      }],
    },
  },
});

GroupMembership

Source: src/AWS/IAM/GroupMembership.ts

An explicit IAM group membership resource that owns a group’s managed users.

GroupMembership models the exact set of users in a group, making membership reconciliation explicit instead of spreading it across user or group resources.

GroupMembership: Managing Group Membership

const admins = yield* Group("Admins", {
  groupName: "admins",
});

const alice = yield* User("Alice", {
  userName: "alice",
});

const bob = yield* User("Bob", {
  userName: "bob",
});

const membership = yield* GroupMembership("AdminsMembership", {
  groupName: admins.groupName,
  userNames: [alice.userName, bob.userName],
});

InstanceProfile

Source: src/AWS/IAM/InstanceProfile.ts

An IAM instance profile that can present a role to EC2 instances.

InstanceProfile bridges IAM roles into EC2 so compute instances can assume the attached role through the instance metadata service.

InstanceProfile: Attaching Roles to EC2

const role = yield* Role("InstanceRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "ec2.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
});

const profile = yield* InstanceProfile("WebProfile", {
  roleName: role.roleName,
});

ListPoliciesGrantingServiceAccess

Source: src/AWS/IAM/ListPoliciesGrantingServiceAccess.ts

Runtime binding for iam:ListPoliciesGrantingServiceAccess — list which attached/inline policies grant an IAM user, group, or role access to given service namespaces. The companion to access advisor for answering “why can this entity reach that service?”.

The entity (Arn) is chosen per request, so the binding takes no arguments and grants iam:ListPoliciesGrantingServiceAccess on *. Provide the implementation with Effect.provide(AWS.IAM.ListPoliciesGrantingServiceAccessHttp).

ListPoliciesGrantingServiceAccess: Access Advisor

// init
const listPoliciesGrantingServiceAccess =
  yield* IAM.ListPoliciesGrantingServiceAccess();

// runtime
const { PoliciesGrantingServiceAccess } =
  yield* listPoliciesGrantingServiceAccess({
    Arn: roleArn,
    ServiceNamespaces: ["s3"],
  });

LoginProfile

Source: src/AWS/IAM/LoginProfile.ts

An IAM console login profile for a user.

LoginProfile manages AWS Management Console access for an IAM user. The password is write-only, so AWS never returns it during later reads.

LoginProfile: Managing Console Access

const user = yield* User("ConsoleUser", {
  userName: "console-user",
});

const profile = yield* LoginProfile("ConsoleLogin", {
  userName: user.userName,
  password: Redacted.make("TempPassword123!"),
  passwordResetRequired: true,
});

OpenIDConnectProvider

Source: src/AWS/IAM/OpenIDConnectProvider.ts

An IAM OpenID Connect provider for web identity federation.

OpenIDConnectProvider registers an external OIDC issuer so IAM roles can be assumed through web identity federation flows such as GitHub Actions.

OpenIDConnectProvider: Federating with OIDC

const oidc = yield* OpenIDConnectProvider("GithubOidc", {
  url: "https://token.actions.githubusercontent.com",
  clientIDList: ["sts.amazonaws.com"],
  thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
});

Policy

Source: src/AWS/IAM/Policy.ts

A customer-managed IAM policy.

Policy owns the lifecycle of the policy metadata and its default version, rotating versions on updates while keeping the current document attached to a stable policy ARN.

Policy: Creating Policies

const policy = yield* Policy("AppPolicy", {
  policyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Action: ["s3:GetObject"],
      Resource: ["arn:aws:s3:::my-bucket/*"],
    }],
  },
});

Role

Source: src/AWS/IAM/Role.ts

An IAM role for AWS services and runtimes.

Role: Creating Roles

const role = yield* Role("TaskRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "ecs-tasks.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
});

Role: Granting Permissions

const policy = yield* Policy("AppPolicy", {
  policyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Action: ["s3:GetObject"],
      Resource: ["arn:aws:s3:::my-bucket/*"],
    }],
  },
});

const role = yield* Role("AppRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "lambda.amazonaws.com" },
      Action: ["sts:AssumeRole"],
    }],
  },
  managedPolicyArns: [policy.policyArn],
  inlinePolicies: {
    Logs: {
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
        Resource: ["*"],
      }],
    },
  },
});

SAMLProvider

Source: src/AWS/IAM/SAMLProvider.ts

An IAM SAML identity provider.

SAMLProvider registers a SAML metadata document so IAM roles can trust an external workforce or application identity provider.

SAMLProvider: Federating with SAML

const provider = yield* SAMLProvider("WorkforceSaml", {
  samlMetadataDocument: "<EntityDescriptor>...</EntityDescriptor>",
});

ServerCertificate

Source: src/AWS/IAM/ServerCertificate.ts

An IAM server certificate.

ServerCertificate uploads and tracks a TLS certificate bundle for legacy IAM-integrated services. The private key is write-only and should be provided as a redacted value when possible.

ServerCertificate: Uploading Server Certificates

const certificate = yield* ServerCertificate("ApiTlsCertificate", {
  certificateBody: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  privateKey: Redacted.make(
    "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
  ),
  certificateChain: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
});

ServiceLinkedRole

Source: src/AWS/IAM/ServiceLinkedRole.ts

An IAM role linked to (and managed by) a specific AWS service.

The linked service controls the role’s trust and permissions policies; the only mutable aspect is the description. Deletion is asynchronous — the provider submits a deletion task and waits (bounded) for it to complete, failing with ServiceLinkedRoleDeletionFailed when the linked service still has resources using the role.

Some services auto-create their service-linked role on first use; deploying this resource over an existing role adopts it (the create API reports the collision and the provider converges on the existing role).

ServiceLinkedRole: Creating Service-Linked Roles

Auto Scaling Service-Linked Role

const role = yield* ServiceLinkedRole("AutoScalingRole", {
  awsServiceName: "autoscaling.amazonaws.com",
});

Suffixed Role for a Dedicated Workload

const role = yield* ServiceLinkedRole("WorkloadRole", {
  awsServiceName: "autoscaling.amazonaws.com",
  customSuffix: "analytics",
  description: "Auto Scaling role scoped to the analytics workload",
});

ServiceSpecificCredential

Source: src/AWS/IAM/ServiceSpecificCredential.ts

A service-specific IAM credential.

ServiceSpecificCredential creates service-bound credentials such as CodeCommit HTTPS passwords for an IAM user. AWS only returns the secret fields during creation, so subsequent reads preserve the originally stored redacted values.

ServiceSpecificCredential: Managing Service Credentials

const user = yield* User("CodeCommitUser", {
  userName: "codecommit-user",
});

const credential = yield* ServiceSpecificCredential("CodeCommitCredential", {
  userName: user.userName,
  serviceName: "codecommit.amazonaws.com",
});

SigningCertificate

Source: src/AWS/IAM/SigningCertificate.ts

An IAM signing certificate for a user.

SigningCertificate uploads an X.509 signing certificate for legacy IAM-integrated workflows that still depend on user-scoped certificates.

SigningCertificate: Managing User Certificates

const user = yield* User("Signer", {
  userName: "build-signer",
});

const certificate = yield* SigningCertificate("SigningCertificate", {
  userName: user.userName,
  certificateBody: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
});

SimulateCustomPolicy

Source: src/AWS/IAM/SimulateCustomPolicy.ts

Runtime binding for iam:SimulateCustomPolicy — evaluate how a set of candidate IAM policy documents would decide a list of actions, without attaching the policies to any entity. The building block for policy linters, “what would this grant?” previews, and authorization test harnesses.

The policies are supplied as strings per request, so the binding takes no arguments and grants iam:SimulateCustomPolicy on *. Provide the implementation with Effect.provide(AWS.IAM.SimulateCustomPolicyHttp).

SimulateCustomPolicy: Simulating Policies

// init
const simulateCustomPolicy = yield* IAM.SimulateCustomPolicy();

// runtime
const { EvaluationResults } = yield* simulateCustomPolicy({
  PolicyInputList: [
    JSON.stringify({
      Version: "2012-10-17",
      Statement: [
        { Effect: "Allow", Action: "s3:ListAllMyBuckets", Resource: "*" },
      ],
    }),
  ],
  ActionNames: ["s3:ListAllMyBuckets", "s3:DeleteBucket"],
});
const decisions = EvaluationResults?.map((r) => r.EvalDecision);

SimulatePrincipalPolicy

Source: src/AWS/IAM/SimulatePrincipalPolicy.ts

Runtime binding for iam:SimulatePrincipalPolicy — evaluate how the policies attached to an existing IAM user, group, or role decide a list of actions. The “can principal X do Y?” primitive behind access-review dashboards and pre-flight permission checks.

The principal (PolicySourceArn) is chosen per request — audit tooling typically iterates entities discovered at runtime — so the binding takes no arguments and grants iam:SimulatePrincipalPolicy on *. Provide the implementation with Effect.provide(AWS.IAM.SimulatePrincipalPolicyHttp).

SimulatePrincipalPolicy: Simulating Policies

// init
const simulatePrincipalPolicy = yield* IAM.SimulatePrincipalPolicy();

// runtime
const { EvaluationResults } = yield* simulatePrincipalPolicy({
  PolicySourceArn: roleArn,
  ActionNames: ["s3:GetObject", "iam:DeleteRole"],
});
const denied = EvaluationResults?.filter(
  (r) => r.EvalDecision !== "allowed",
);

SSHPublicKey

Source: src/AWS/IAM/SSHPublicKey.ts

An IAM SSH public key for CodeCommit-compatible workflows.

SSHPublicKey uploads and manages a user’s public key for services such as AWS CodeCommit that authenticate through IAM-backed SSH credentials.

SSHPublicKey: Managing SSH Keys

const user = yield* User("GitUser", {
  userName: "codecommit-user",
});

const key = yield* SSHPublicKey("GitKey", {
  userName: user.userName,
  sshPublicKeyBody: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample codecommit-user",
});

User

Source: src/AWS/IAM/User.ts

An IAM user with optional inline policies, managed policies, and tags.

User manages a long-lived IAM identity together with its attached managed policies, inline policies, permissions boundary, and tags.

User: Creating IAM Users

const user = yield* User("AppUser", {
  userName: "app-user",
  managedPolicyArns: [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
  ],
});

VirtualMFADevice

Source: src/AWS/IAM/VirtualMFADevice.ts

An IAM virtual MFA device.

VirtualMFADevice creates a software MFA device and can optionally activate it for a user during creation when the initial authentication codes are provided.

VirtualMFADevice: Managing MFA Devices

const user = yield* User("AdminUser", {
  userName: "admin-user",
});

const device = yield* VirtualMFADevice("AdminMfa", {
  userName: user.userName,
  authenticationCode1: "123456",
  authenticationCode2: "654321",
});