# AWS IAM Manage AWS IAM users, roles, policies, and groups ## Usage Instructions Integrate AWS Identity and Access Management into your workflow. Create and manage users, roles, policies, groups, and access keys. ## Tools ### `iam_list_users` List IAM users in your AWS account #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `pathPrefix` | string | No | Path prefix to filter users (e.g., /division\_abc/) | | `maxItems` | number | No | Maximum number of users to return (1-1000, default 100) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------- | ------- | ------------------------------------------------------------- | | `users` | json | List of IAM users with userName, userId, arn, path, and dates | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of users returned | ### `iam_get_user` Get detailed information about an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------------------------ | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | No | The name of the IAM user to retrieve (defaults to the caller if omitted) | #### Output | Parameter | Type | Description | | ------------------------ | ------ | -------------------------------------------- | | `userName` | string | The name of the user | | `userId` | string | The unique ID of the user | | `arn` | string | The ARN of the user | | `path` | string | The path to the user | | `createDate` | string | Date the user was created | | `passwordLastUsed` | string | Date the password was last used | | `permissionsBoundaryArn` | string | ARN of the permissions boundary policy | | `tags` | json | Tags attached to the user (key, value pairs) | ### `iam_create_user` Create a new IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | -------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | Name for the new IAM user (1-64 characters) | | `path` | string | No | Path for the user (e.g., /division\_abc/), defaults to / | #### Output | Parameter | Type | Description | | ------------ | ------ | --------------------------------- | | `message` | string | Operation status message | | `userName` | string | The name of the created user | | `userId` | string | The unique ID of the created user | | `arn` | string | The ARN of the created user | | `path` | string | The path of the created user | | `createDate` | string | Date the user was created | ### `iam_delete_user` Delete an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | The name of the IAM user to delete | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_list_roles` List IAM roles in your AWS account #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `pathPrefix` | string | No | Path prefix to filter roles (e.g., /application/) | | `maxItems` | number | No | Maximum number of roles to return (1-1000, default 100) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------- | ------- | ------------------------------------------------------------- | | `roles` | json | List of IAM roles with roleName, roleId, arn, path, and dates | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of roles returned | ### `iam_get_role` Get detailed information about an IAM role #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------ | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | The name of the IAM role to retrieve | #### Output | Parameter | Type | Description | | -------------------------- | ------ | --------------------------------------- | | `roleName` | string | The name of the role | | `roleId` | string | The unique ID of the role | | `arn` | string | The ARN of the role | | `path` | string | The path to the role | | `createDate` | string | Date the role was created | | `description` | string | Description of the role | | `maxSessionDuration` | number | Maximum session duration in seconds | | `assumeRolePolicyDocument` | string | The trust policy document (JSON) | | `roleLastUsedDate` | string | Date the role was last used | | `roleLastUsedRegion` | string | AWS region where the role was last used | ### `iam_create_role` Create a new IAM role with a trust policy #### Input | Parameter | Type | Required | Description | | -------------------------- | ------ | -------- | -------------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | Name for the new IAM role (1-64 characters) | | `assumeRolePolicyDocument` | string | Yes | Trust policy JSON specifying who can assume this role | | `description` | string | No | Description of the role | | `path` | string | No | Path for the role (e.g., /application/), defaults to / | | `maxSessionDuration` | number | No | Maximum session duration in seconds (3600-43200, default 3600) | #### Output | Parameter | Type | Description | | ------------ | ------ | --------------------------------- | | `message` | string | Operation status message | | `roleName` | string | The name of the created role | | `roleId` | string | The unique ID of the created role | | `arn` | string | The ARN of the created role | | `path` | string | The path of the created role | | `createDate` | string | Date the role was created | ### `iam_delete_role` Delete an IAM role #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | The name of the IAM role to delete | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_attach_user_policy` Attach a managed policy to an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | --------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | The name of the IAM user | | `policyArn` | string | Yes | The ARN of the managed policy to attach | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_detach_user_policy` Remove a managed policy from an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | --------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | The name of the IAM user | | `policyArn` | string | Yes | The ARN of the managed policy to detach | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_attach_role_policy` Attach a managed policy to an IAM role #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | --------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | The name of the IAM role | | `policyArn` | string | Yes | The ARN of the managed policy to attach | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_detach_role_policy` Remove a managed policy from an IAM role #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | --------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | The name of the IAM role | | `policyArn` | string | Yes | The ARN of the managed policy to detach | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_list_policies` List managed IAM policies #### Input | Parameter | Type | Required | Description | | ----------------- | ------- | -------- | -------------------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `scope` | string | No | Filter by scope: All, AWS (AWS-managed), or Local (customer-managed) | | `onlyAttached` | boolean | No | If true, only return policies attached to an entity | | `pathPrefix` | string | No | Path prefix to filter policies | | `maxItems` | number | No | Maximum number of policies to return (1-1000, default 100) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------- | ------- | ----------------------------------------------------------------- | | `policies` | json | List of policies with policyName, arn, attachmentCount, and dates | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of policies returned | ### `iam_create_access_key` Create a new access key pair for an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | No | The IAM user to create the key for (defaults to current user) | #### Output | Parameter | Type | Description | | ----------------- | ------ | ------------------------------------------- | | `message` | string | Operation status message | | `accessKeyId` | string | The new access key ID | | `secretAccessKey` | string | The new secret access key (only shown once) | | `userName` | string | The user the key was created for | | `status` | string | Status of the access key (Active) | | `createDate` | string | Date the key was created | ### `iam_delete_access_key` Delete an access key pair for an IAM user #### Input | Parameter | Type | Required | Description | | --------------------- | ------ | -------- | ----------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `accessKeyIdToDelete` | string | Yes | The access key ID to delete | | `userName` | string | No | The IAM user whose key to delete (defaults to current user) | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_list_groups` List IAM groups in your AWS account #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | -------------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `pathPrefix` | string | No | Path prefix to filter groups | | `maxItems` | number | No | Maximum number of groups to return (1-1000, default 100) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------- | ------- | --------------------------------------------------------- | | `groups` | json | List of IAM groups with groupName, groupId, arn, and path | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of groups returned | ### `iam_add_user_to_group` Add an IAM user to a group #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | The name of the IAM user | | `groupName` | string | Yes | The name of the IAM group | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_remove_user_from_group` Remove an IAM user from a group #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | The name of the IAM user | | `groupName` | string | Yes | The name of the IAM group | #### Output | Parameter | Type | Description | | --------- | ------ | ------------------------ | | `message` | string | Operation status message | ### `iam_list_attached_role_policies` List all managed policies attached to an IAM role #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `roleName` | string | Yes | Name of the IAM role | | `pathPrefix` | string | No | Path prefix to filter policies (e.g., /application/) | | `maxItems` | number | No | Maximum number of policies to return (1-1000) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------------ | ------- | ------------------------------------------------------- | | `attachedPolicies` | json | List of attached policies with policyName and policyArn | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of attached policies returned | ### `iam_list_attached_user_policies` List all managed policies attached to an IAM user #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ---------------------------------------------------- | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `userName` | string | Yes | Name of the IAM user | | `pathPrefix` | string | No | Path prefix to filter policies (e.g., /application/) | | `maxItems` | number | No | Maximum number of policies to return (1-1000) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------------ | ------- | ------------------------------------------------------- | | `attachedPolicies` | json | List of attached policies with policyName and policyArn | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of attached policies returned | ### `iam_simulate_principal_policy` Simulate whether a user, role, or group is allowed to perform specific AWS actions — useful for pre-flight access checks #### Input | Parameter | Type | Required | Description | | ----------------- | ------ | -------- | ------------------------------------------------------------------------------------------ | | `region` | string | Yes | AWS region (e.g., us-east-1) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `policySourceArn` | string | Yes | ARN of the user, group, or role to simulate (e.g., arn:aws:iam::123456789012:user/alice) | | `actionNames` | string | Yes | Comma-separated list of AWS actions to simulate (e.g., s3:GetObject,ec2:DescribeInstances) | | `resourceArns` | string | No | Comma-separated list of resource ARNs to simulate against (defaults to \* if not provided) | | `maxResults` | number | No | Maximum number of simulation results to return (1-1000) | | `marker` | string | No | Pagination marker from a previous request | #### Output | Parameter | Type | Description | | ------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `evaluationResults` | json | Simulation results per action: evalActionName, evalResourceName, evalDecision (allowed/explicitDeny/implicitDeny), matchedStatements (sourcePolicyId, sourcePolicyType), missingContextValues | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of evaluation results returned |