Smaws_Client_IAM.Typestype nonrec attached_permissions_boundary = {permissions_boundary_arn : arn_type option;The ARN of the policy used to set the permissions boundary for the user or role.
*)permissions_boundary_type : permissions_boundary_attachment_type option;The permissions boundary usage type that indicates what type of IAM resource is used as the permissions boundary for an entity. This data type can only have a value of Policy.
}Contains information about an attached permissions boundary.
An attached permissions boundary is a managed policy that has been attached to a user or role to set the permissions boundary.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
type nonrec tag = {value : tag_value_type;The value associated with this tag. For example, tags with a key name of Department could have values such as Human Resources, Accounting, and Support. Tags with a key name of Cost Center might have values that consist of the number associated with the different cost centers in your company. Typically, many resources have tags with the same key name but with different values.
key : tag_key_type;The key name that can be used to look up or retrieve the associated value. For example, Department or Cost Center are common choices.
}A structure that represents user-provided metadata that can be associated with an IAM resource. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
type nonrec tag_list_type = tag listtype nonrec user = {permissions_boundary : attached_permissions_boundary option;For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)password_last_used : date_type option;The date and time, in ISO 8601 date-time format, when the user's password was last used to sign in to an Amazon Web Services website. For a list of Amazon Web Services websites that capture a user's last sign-in time, see the Credential reports topic in the IAM User Guide. If a password is used more than once in a five-minute span, only the first use is returned in this field. If the field is null (no value), then it indicates that they never signed in with a password. This can be because:
A null value does not mean that the user never had a password. Also, if the user does not currently have a password but had one in the past, then this field contains the date and time the most recent password was used.
This value is returned only in the GetUser and ListUsers operations.
*)create_date : date_type;arn : arn_type;The Amazon Resource Name (ARN) that identifies the user. For more information about ARNs and how to use ARNs in policies, see IAM Identifiers in the IAM User Guide.
*)user_id : id_type;The stable and unique string identifying the user. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)user_name : user_name_type;The friendly name identifying the user.
*)path : path_type;The path to the user. For more information about paths, see IAM identifiers in the IAM User Guide.
The ARN of the policy used to set the permissions boundary for the user.
*)}Contains information about an IAM user entity.
This data type is used as a response element in the following operations:
type nonrec virtual_mfa_device = {enable_date : date_type option;The date and time on which the virtual MFA device was enabled.
*)user : user option;The IAM user associated with this virtual MFA device.
*)qr_code_pn_g : bootstrap_datum option;A QR code PNG image that encodes otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String where $virtualMFADeviceName is one of the create call arguments. AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in base32 format. The Base32String value is base64-encoded.
base32_string_seed : bootstrap_datum option;serial_number : serial_number_type;The serial number associated with VirtualMFADevice.
}Contains information about a virtual MFA device.
type nonrec virtual_mfa_device_list_type = virtual_mfa_device listtype nonrec user_list_type = user listtype nonrec policy_detail = {policy_document : policy_document_type option;The policy document.
*)policy_name : policy_name_type option;The name of the policy.
*)}Contains information about an IAM policy, including the policy document.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
type nonrec policy_detail_list_type = policy_detail listtype nonrec group_name_list_type = group_name_type listtype nonrec attached_policy = {policy_arn : arn_type option;policy_name : policy_name_type option;The friendly name of the attached policy.
*)}Contains information about an attached policy.
An attached policy is a managed policy that has been attached to a user, group, or role. This data type is used as a response element in the ListAttachedGroupPolicies, ListAttachedRolePolicies, ListAttachedUserPolicies, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec attached_policies_list_type = attached_policy listtype nonrec user_detail = {permissions_boundary : attached_permissions_boundary option;The ARN of the policy used to set the permissions boundary for the user.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)attached_managed_policies : attached_policies_list_type option;A list of the managed policies attached to the user.
*)group_list : group_name_list_type option;A list of IAM groups that the user is in.
*)user_policy_list : policy_detail_list_type option;A list of the inline policies embedded in the user.
*)create_date : date_type option;arn : arn_type option;user_id : id_type option;The stable and unique string identifying the user. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)user_name : user_name_type option;The friendly name identifying the user.
*)path : path_type option;The path to the user. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an IAM user, including all the user's policies and all the IAM groups the user is in.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
type nonrec user_detail_list_type = user_detail listtype nonrec thumbprint_list_type = thumbprint_type listtype nonrec tag_key_list_type = tag_key_type listtype nonrec summary_key_type = | RolesQuota| Roles| RolePolicySizeQuota| Providers| InstanceProfilesQuota| InstanceProfiles| AssumeRolePolicySizeQuota| GlobalEndpointTokenVersion| VersionsPerPolicyQuota| PolicyVersionsInUseQuota| PolicyVersionsInUse| PolicySizeQuota| PoliciesQuota| Policies| AttachedPoliciesPerUserQuota| AttachedPoliciesPerRoleQuota| AttachedPoliciesPerGroupQuota| AccountSigningCertificatesPresent| AccountPasswordPresent| AccountAccessKeysPresent| AccountMFAEnabled| MFADevicesInUse| MFADevices| AccessKeysPerUserQuota| SigningCertificatesPerUserQuota| GroupsPerUserQuota| GroupPolicySizeQuota| UserPolicySizeQuota| ServerCertificatesQuota| ServerCertificates| GroupsQuota| Groups| UsersQuota| Userstype nonrec summary_map_type = (summary_key_type * summary_value_type) listtype nonrec service_namespace_list_type = service_namespace_type listtype nonrec server_certificate_metadata = {expiration : date_type option;The date on which the certificate is set to expire.
*)upload_date : date_type option;The date when the server certificate was uploaded.
*)arn : arn_type;The Amazon Resource Name (ARN) specifying the server certificate. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
*)server_certificate_id : id_type;The stable and unique string identifying the server certificate. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)server_certificate_name : server_certificate_name_type;The name that identifies the server certificate.
*)path : path_type;The path to the server certificate. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about a server certificate without its certificate body, certificate chain, and private key.
This data type is used as a response element in the UploadServerCertificate and ListServerCertificates operations.
type nonrec server_certificate_metadata_list_type =
server_certificate_metadata listtype nonrec role_permission_restriction_arn_list_type = arn_type listtype nonrec role_last_used = {region : string_type option;The name of the Amazon Web Services Region in which the role was last used.
*)last_used_date : date_type option;The date and time, in ISO 8601 date-time format that the role was last used.
This field is null if the role has not been used within the IAM tracking period. For more information about the tracking period, see Regions where data is tracked in the IAM User Guide.
*)}Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
This data type is returned as a response element in the GetRole and GetAccountAuthorizationDetails operations.
type nonrec role = {role_last_used : role_last_used option;Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM user Guide.
*)permissions_boundary : attached_permissions_boundary option;The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)max_session_duration : role_max_session_duration_type option;The maximum session duration (in seconds) for the specified role. Anyone who uses the CLI, or API to assume the role can specify the duration using the optional DurationSeconds API parameter or duration-seconds CLI parameter.
description : role_description_type option;A description of the role that you provide.
*)assume_role_policy_document : policy_document_type option;The policy that grants an entity permission to assume the role.
*)create_date : date_type;arn : arn_type;The Amazon Resource Name (ARN) specifying the role. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide guide.
*)role_id : id_type;The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)role_name : role_name_type;The friendly name that identifies the role.
*)path : path_type;The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an IAM role. This structure is returned as a response element in several API operations that interact with roles.
type nonrec role_list_type = role listtype nonrec instance_profile = {roles : role_list_type;The role associated with the instance profile.
*)create_date : date_type;The date when the instance profile was created.
*)arn : arn_type;The Amazon Resource Name (ARN) specifying the instance profile. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
*)instance_profile_id : id_type;The stable and unique string identifying the instance profile. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)instance_profile_name : instance_profile_name_type;The name identifying the instance profile.
*)path : path_type;The path to the instance profile. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an instance profile.
This data type is used as a response element in the following operations:
type nonrec instance_profile_list_type = instance_profile listtype nonrec role_detail = {role_last_used : role_last_used option;Contains information about the last time that an IAM role was used. This includes the date and time and the Region in which the role was last used. Activity is only reported for the trailing 400 days. This period can be shorter if your Region began supporting these features within the last year. The role might have been used more than 400 days ago. For more information, see Regions where data is tracked in the IAM User Guide.
*)permissions_boundary : attached_permissions_boundary option;The ARN of the policy used to set the permissions boundary for the role.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)attached_managed_policies : attached_policies_list_type option;A list of managed policies attached to the role. These policies are the role's access (permissions) policies.
*)role_policy_list : policy_detail_list_type option;A list of inline policies embedded in the role. These policies are the role's access (permissions) policies.
*)instance_profile_list : instance_profile_list_type option;A list of instance profiles that contain this role.
*)assume_role_policy_document : policy_document_type option;The trust policy that grants permission to assume the role.
*)create_date : date_type option;arn : arn_type option;role_id : id_type option;The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)role_name : role_name_type option;The friendly name that identifies the role.
*)path : path_type option;The path to the role. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an IAM role, including all of the role's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
type nonrec role_detail_list_type = role_detail listtype nonrec saml_private_key = {timestamp : date_type option;key_id : private_key_id_type option;The unique identifier for the SAML private key.
*)}Contains the private keys for the SAML provider.
This data type is used as a response element in the GetSAMLProvider operation.
type nonrec private_key_list = saml_private_key listtype nonrec policy_parameter_values_list_type =
policy_parameter_value_type listtype nonrec policy_parameter = {type_ : policy_parameter_type_enum option;The data type of the policy parameter value.
*)values : policy_parameter_values_list_type option;The allowed values for the policy parameter.
*)name : policy_parameter_name_type option;The name of the policy parameter.
*)}Contains information about a policy parameter used to customize delegated permissions.
type nonrec policy_parameter_list_type = policy_parameter listtype nonrec policy_name_list_type = policy_name_type listtype nonrec policy = {update_date : date_type option;The date and time, in ISO 8601 date-time format, when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
*)create_date : date_type option;description : policy_description_type option;A friendly description of the policy.
This element is included in the response to the GetPolicy operation. It is not included in the response to the ListPolicies operation.
*)is_attachable : boolean_type option;Specifies whether the policy can be attached to an IAM user, group, or role.
*)permissions_boundary_usage_count : attachment_count_type option;The number of entities (users and roles) for which the policy is used to set the permissions boundary.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)attachment_count : attachment_count_type option;The number of entities (users, groups, and roles) that the policy is attached to.
*)default_version_id : policy_version_id_type option;The identifier for the version of the policy that is set as the default version.
*)path : policy_path_type option;The path to the policy.
For more information about paths, see IAM identifiers in the IAM User Guide.
*)arn : arn_type option;policy_id : id_type option;The stable and unique string identifying the policy.
For more information about IDs, see IAM identifiers in the IAM User Guide.
*)policy_name : policy_name_type option;The friendly name (not ARN) identifying the policy.
*)}Contains information about a managed policy.
This data type is used as a response element in the CreatePolicy, GetPolicy, and ListPolicies operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec policy_list_type = policy listtype nonrec policy_granting_service_access = {entity_name : entity_name_type option;The name of the entity (user or role) to which the inline policy is attached.
This field is null for managed policies. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.
*)entity_type : policy_owner_entity_type option;The type of entity (user or role) that used the policy to access the service to which the inline policy is attached.
This field is null for managed policies. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.
*)policy_arn : arn_type option;policy_type : policy_type;The policy type. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.
*)policy_name : policy_name_type;The policy name.
*)}Contains details about the permissions policies that are attached to the specified identity (user, group, or role).
This data type is an element of the ListPoliciesGrantingServiceAccessEntry object.
type nonrec policy_granting_service_access_list_type =
policy_granting_service_access listtype nonrec policy_version = {create_date : date_type option;is_default_version : boolean_type option;Specifies whether the policy version is set as the policy's default version.
*)version_id : policy_version_id_type option;The identifier for the policy version.
Policy version identifiers always begin with v (always lowercase). When a policy is created, the first policy version is v1.
document : policy_document_type option;The policy document.
The policy document is returned in the response to the GetPolicyVersion and GetAccountAuthorizationDetails operations. It is not returned in the response to the CreatePolicyVersion or ListPolicyVersions operations.
The policy document returned in this structure is URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
}Contains information about a version of a managed policy.
This data type is used as a response element in the CreatePolicyVersion, GetPolicyVersion, ListPolicyVersions, and GetAccountAuthorizationDetails operations.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec policy_document_version_list_type = policy_version listtype nonrec mfa_device = {enable_date : date_type;The date when the MFA device was enabled for the user.
*)serial_number : serial_number_type;The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.
*)user_name : user_name_type;The user with whom the MFA device is associated.
*)}Contains information about an MFA device.
This data type is used as a response element in the ListMFADevices operation.
type nonrec mfa_device_list_type = mfa_device listtype nonrec list_policies_granting_service_access_entry = {policies : policy_granting_service_access_list_type option;The PoliciesGrantingServiceAccess object that contains details about the policy.
service_namespace : service_namespace_type option;The namespace of the service that was accessed.
To learn the service namespace of a service, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.
}Contains details about the permissions policies that are attached to the specified identity (user, group, or role).
This data type is used as a response element in the ListPoliciesGrantingServiceAccess operation.
type nonrec list_policy_granting_service_access_response_list_type =
list_policies_granting_service_access_entry listtype nonrec group = {create_date : date_type;arn : arn_type;The Amazon Resource Name (ARN) specifying the group. For more information about ARNs and how to use them in policies, see IAM identifiers in the IAM User Guide.
*)group_id : id_type;The stable and unique string identifying the group. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)group_name : group_name_type;The friendly name that identifies the group.
*)path : path_type;The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an IAM group entity.
This data type is used as a response element in the following operations:
type nonrec group_list_type = group listtype nonrec group_detail = {attached_managed_policies : attached_policies_list_type option;A list of the managed policies attached to the group.
*)group_policy_list : policy_detail_list_type option;A list of the inline policies embedded in the group.
*)create_date : date_type option;arn : arn_type option;group_id : id_type option;The stable and unique string identifying the group. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)group_name : group_name_type option;The friendly name that identifies the group.
*)path : path_type option;The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.
*)}Contains information about an IAM group, including all of the group's policies.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
type nonrec group_detail_list_type = group_detail listtype nonrec entity_list_type = entity_type listtype nonrec entity_info = {path : path_type option;The path to the entity (user or role). For more information about paths, see IAM identifiers in the IAM User Guide.
*)id : id_type;The identifier of the entity (user or role).
*)type_ : policy_owner_entity_type;The type of entity (user or role).
*)name : user_name_type;The name of the entity (user or role).
*)arn : arn_type;}Contains details about the specified entity (user or role).
This data type is an element of the EntityDetails object.
type nonrec entity_details = {last_authenticated : date_type option;The date and time, in ISO 8601 date-time format, when the authenticated entity last attempted to access Amazon Web Services. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)entity_info : entity_info;The EntityInfo object that contains details about the entity (user or role).
}An object that contains details about when the IAM entities (users or roles) were last used in an attempt to access the specified Amazon Web Services service.
This data type is a response element in the GetServiceLastAccessedDetailsWithEntities operation.
type nonrec entity_details_list_type = entity_details listtype nonrec delegation_permission = {parameters : policy_parameter_list_type option;A list of policy parameters that define the scope and constraints of the delegated permissions.
*)policy_template_arn : arn_type option;This ARN maps to a pre-registered policy content for this partner. See the partner onboarding documentation to understand how to create a delegation template.
*)}Contains information about the permissions being delegated in a delegation request.
type nonrec delegation_request = {updated_time : date_type option;Last updated timestamp of the request.
*)only_send_by_owner : boolean_type option;A flag indicating whether the SendDelegationToken must be called by the owner of this delegation request. This is set by the requesting partner.
*)rejection_reason : notes_type option;Reasons for rejecting this delegation request, if this request was rejected. See also RejectDelegationRequest API documentation.
*)notes : notes_type option;Notes added to this delegation request, if this request was updated via the UpdateDelegationRequest API.
*)redirect_url : redirect_url_type option;A URL to be redirected to once the delegation request is approved. Partners provide this URL when creating the delegation request.
*)session_duration : session_duration_type option;The life-time of the requested session credential.
*)create_date : date_type option;Creation date (timestamp) of this delegation request.
*)requestor_name : requestor_name_type option;A friendly name of the requestor.
*)requestor_id : account_id_type option;Identity of the requestor of this delegation request. This will be an Amazon Web Services account ID.
*)expiration_time : date_type option;The expiry time of this delegation request
See the Understanding the Request Lifecycle for details on the life time of a delegation request at each state.
*)state : state_type option;The state of this delegation request.
See the Understanding the Request Lifecycle for an explanation of how these states are transitioned.
*)approver_id : arn_type option;owner_id : owner_id_type option;ARN of the owner of this delegation request.
*)role_permission_restriction_arns : role_permission_restriction_arn_list_type
option;If the PermissionPolicy includes role creation permissions, this element will include the list of permissions boundary policies associated with the role creation. See Permissions boundaries for IAM entities for more details about IAM permission boundaries.
permission_policy : permission_type option;JSON content of the associated permission policy of this delegation request.
*)permissions : delegation_permission option;request_message : request_message_type option;A custom message that is added to the delegation request by the partner.
This element is different from the Description element such that this is a request specific message injected by the partner. The Description is typically a generic explanation of what the delegation request is targeted to do.
description : delegation_request_description_type option;Description of the delegation request. This is a message that is provided by the Amazon Web Services partner that filed the delegation request.
*)owner_account_id : account_id_type option;Amazon Web Services account ID of the owner of the delegation request.
*)delegation_request_id : delegation_request_id_type option;The unique identifier for the delegation request.
*)}Contains information about a delegation request, including its status, permissions, and associated metadata.
type nonrec delegation_requests_list_type = delegation_request listtype nonrec client_id_list_type = client_id_type listtype nonrec signing_certificate = {upload_date : date_type option;The date when the signing certificate was uploaded.
*)status : status_type;The status of the signing certificate. Active means that the key is valid for API calls, while Inactive means it is not.
certificate_body : certificate_body_type;The contents of the signing certificate.
*)certificate_id : certificate_id_type;The ID for the signing certificate.
*)user_name : user_name_type;The name of the user the signing certificate is associated with.
*)}Contains information about an X.509 signing certificate.
This data type is used as a response element in the UploadSigningCertificate and ListSigningCertificates operations.
type nonrec certificate_list_type = signing_certificate listtype nonrec account_alias_list_type = account_alias_type listtype nonrec access_key_metadata = {create_date : date_type option;The date when the access key was created.
*)status : status_type option;The status of the access key. Active means that the key is valid for API calls; Inactive means it is not.
access_key_id : access_key_id_type option;The ID for this access key.
*)user_name : user_name_type option;The name of the IAM user that the key is associated with.
*)}Contains information about an Amazon Web Services access key, without its secret key.
This data type is used as a response element in the ListAccessKeys operation.
type nonrec access_key_metadata_list_type = access_key_metadata listtype nonrec upload_signing_certificate_response = {certificate : signing_certificate;Information about the certificate.
*)}Contains the response to a successful UploadSigningCertificate request.
type nonrec upload_signing_certificate_request = {certificate_body : certificate_body_type;The contents of the signing certificate.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)user_name : existing_user_name_type option;The name of the user the signing certificate is for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}The request processing has failed because of an unknown error, exception or failure.
The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.
The request was rejected because the certificate was malformed or expired. The error message describes the specific error.
The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.
The request was rejected because the certificate is invalid.
The request was rejected because it attempted to create a resource that already exists.
The request was rejected because the same certificate is associated with an IAM user in the account.
The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.
type nonrec upload_server_certificate_response = {server_certificate_metadata : server_certificate_metadata option;The meta information of the uploaded server certificate without its certificate body, certificate chain, and private key.
*)}Contains the response to a successful UploadServerCertificate request.
type nonrec upload_server_certificate_request = {certificate_chain : certificate_chain_type option;The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)private_key : private_key_type;The contents of the private key in PEM-encoded format.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)certificate_body : certificate_body_type;The contents of the public key certificate in PEM-encoded format.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)server_certificate_name : server_certificate_name_type;The name for the server certificate. Do not include the path in this value. The name of the certificate cannot contain any spaces.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)path : path_type option;The path for the server certificate. For more information about paths, see IAM identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
If you are uploading a server certificate specifically for use with Amazon CloudFront distributions, you must specify a path using the path parameter. The path must begin with /cloudfront and must include a trailing slash (for example, /cloudfront/test/).
}The request was rejected because the public key certificate and the private key do not match.
The request was rejected because an invalid or out-of-range value was supplied for an input parameter.
type nonrec ssh_public_key = {upload_date : date_type option;status : status_type;The status of the SSH public key. Active means that the key can be used for authentication with an CodeCommit repository. Inactive means that the key cannot be used.
ssh_public_key_body : public_key_material_type;The SSH public key.
*)fingerprint : public_key_fingerprint_type;The MD5 message digest of the SSH public key.
*)ssh_public_key_id : public_key_id_type;The unique identifier for the SSH public key.
*)user_name : user_name_type;The name of the IAM user associated with the SSH public key.
*)}Contains information about an SSH public key.
This data type is used as a response element in the GetSSHPublicKey and UploadSSHPublicKey operations.
type nonrec upload_ssh_public_key_response = {ssh_public_key : ssh_public_key option;Contains information about the SSH public key.
*)}Contains the response to a successful UploadSSHPublicKey request.
type nonrec upload_ssh_public_key_request = {ssh_public_key_body : public_key_material_type;The SSH public key. The public key must be encoded in ssh-rsa format or PEM format. The minimum bit-length of the public key is 2048 bits. For example, you can generate a 2048-bit key, and the resulting PEM file is 1679 bytes long.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)user_name : user_name_type;The name of the IAM user to associate the SSH public key with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec unrecognized_public_key_encoding_exception = {message : unrecognized_public_key_encoding_message option;}The request was rejected because the public key encoding format is unsupported or unrecognized.
The request was rejected because the public key is malformed or otherwise invalid.
type nonrec duplicate_ssh_public_key_exception = {message : duplicate_ssh_public_key_message option;}The request was rejected because the SSH public key is already associated with the specified IAM user.
type nonrec update_user_request = {new_user_name : user_name_type option;New name for the user. Include this parameter only if you're changing the user's name.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
*)new_path : path_type option;New path for the IAM user. Include this parameter only if you're changing the user's path.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
user_name : existing_user_name_type;Name of the user to update. If you're changing the name of the user, this is the original user name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec entity_temporarily_unmodifiable_exception = {message : entity_temporarily_unmodifiable_message option;}The request was rejected because it referenced an entity that is temporarily unmodifiable, such as a user name that was deleted and then recreated. The error indicates that the request is likely to succeed if you try again after waiting several minutes. The error message describes the entity.
type nonrec update_signing_certificate_request = {status : status_type;The status you want to assign to the certificate. Active means that the certificate can be used for programmatic calls to Amazon Web Services Inactive means that the certificate cannot be used.
certificate_id : certificate_id_type;The ID of the signing certificate you want to update.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : existing_user_name_type option;The name of the IAM user the signing certificate belongs to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec update_service_specific_credential_request = {status : status_type;The status to be assigned to the service-specific credential.
*)service_specific_credential_id : service_specific_credential_id;The unique identifier of the service-specific credential.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type option;The name of the IAM user associated with the service-specific credential. If you do not specify this value, then the operation assumes the user whose credentials are used to call the operation.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec update_server_certificate_request = {new_server_certificate_name : server_certificate_name_type option;The new name for the server certificate. Include this only if you are updating the server certificate's name. The name of the certificate cannot contain any spaces.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)new_path : path_type option;The new path for the server certificate. Include this only if you are updating the server certificate's path.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
server_certificate_name : server_certificate_name_type;The name of the server certificate that you want to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec update_ssh_public_key_request = {status : status_type;The status to assign to the SSH public key. Active means that the key can be used for authentication with an CodeCommit repository. Inactive means that the key cannot be used.
ssh_public_key_id : public_key_id_type;The unique identifier for the SSH public key.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type;The name of the IAM user associated with the SSH public key.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec update_saml_provider_response = {saml_provider_arn : arn_type option;The Amazon Resource Name (ARN) of the SAML provider that was updated.
*)}Contains the response to a successful UpdateSAMLProvider request.
type nonrec update_saml_provider_request = {remove_private_key : private_key_id_type option;The Key ID of the private key to remove.
*)add_private_key : private_key_type option;Specifies the new private key from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
*)assertion_encryption_mode : assertion_encryption_mode_type option;Specifies the encryption setting for the SAML provider.
*)saml_provider_arn : arn_type;The Amazon Resource Name (ARN) of the SAML provider to update.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)saml_metadata_document : saml_metadata_document_type option;An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your IdP.
*)}type nonrec update_role_request = {max_session_duration : role_max_session_duration_type option;The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.
Anyone who assumes the role from the CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM roles in the IAM User Guide.
IAM role credentials provided by Amazon EC2 instances assigned to the role are not subject to the specified maximum session duration.
*)description : role_description_type option;The new description that you want to apply to the specified role.
*)role_name : role_name_type;The name of the role that you want to modify.
*)}type nonrec update_role_description_response = {role : role option;A structure that contains details about the modified role.
*)}type nonrec update_role_description_request = {description : role_description_type;The new description that you want to apply to the specified role.
*)role_name : role_name_type;The name of the role that you want to modify.
*)}The request was rejected because service-linked roles are protected Amazon Web Services resources. Only the service that depends on the service-linked role can modify or delete the role on your behalf. The error message includes the name of the service that depends on this service-linked role. You must request the change through that service.
type nonrec update_open_id_connect_provider_thumbprint_request = {thumbprint_list : thumbprint_list_type;A list of certificate thumbprints that are associated with the specified IAM OpenID Connect provider. For more information, see CreateOpenIDConnectProvider.
*)open_id_connect_provider_arn : arn_type;The Amazon Resource Name (ARN) of the IAM OIDC provider resource object for which you want to update the thumbprint. You can get a list of OIDC provider ARNs by using the ListOpenIDConnectProviders operation.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec update_login_profile_request = {password_reset_required : boolean_object_type option;Allows this new password to be used only once by requiring the specified IAM user to set a new password on next sign-in.
*)password : password_type option;The new password for the specified IAM user.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)However, the format can be further restricted by the account administrator by setting a password policy on the Amazon Web Services account. For more information, see UpdateAccountPasswordPolicy.
*)user_name : user_name_type;The name of the user whose password you want to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec password_policy_violation_exception = {message : password_policy_violation_message option;}The request was rejected because the provided password did not meet the requirements imposed by the account password policy.
type nonrec update_group_request = {new_group_name : group_name_type option;New name for the IAM group. Only include this if changing the group's name.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
*)new_path : path_type option;New path for the IAM group. Only include this if changing the group's path.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
group_name : group_name_type;Name of the IAM group to update. If you're changing the name of the group, this is the original name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec update_delegation_request_request = {notes : notes_type option;Additional notes or comments to add to the delegation request.
*)delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request to update.
*)}type nonrec update_assume_role_policy_request = {policy_document : policy_document_type;The policy that grants an entity permission to assume the role.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)role_name : role_name_type;The name of the role to update with the new policy.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec malformed_policy_document_exception = {message : malformed_policy_document_message option;}The request was rejected because the policy document was malformed. The error message describes the specific error.
type nonrec update_account_password_policy_request = {hard_expiry : boolean_object_type option;Prevents IAM users who are accessing the account via the Amazon Web Services Management Console from setting a new console password after their password has expired. The IAM user cannot access the console until an administrator resets the password.
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that IAM users can change their passwords after they expire and continue to sign in as the user.
In the Amazon Web Services Management Console, the custom password policy option Allow users to change their own password gives IAM users permissions to iam:ChangePassword for only their user and to the iam:GetAccountPasswordPolicy action. This option does not attach a permissions policy to each user, rather the permissions are applied at the account-level for all users by IAM. IAM users with iam:ChangePassword permission and active access keys can reset their own expired console password using the CLI or API.
password_reuse_prevention : password_reuse_prevention_type option;Specifies the number of previous passwords that IAM users are prevented from reusing.
If you do not specify a value for this parameter, then the operation uses the default value of 0. The result is that IAM users are not prevented from reusing previous passwords.
max_password_age : max_password_age_type option;The number of days that an IAM user password is valid.
If you do not specify a value for this parameter, then the operation uses the default value of 0. The result is that IAM user passwords never expire.
allow_users_to_change_password : boolean_type option;Allows all IAM users in your account to use the Amazon Web Services Management Console to change their own passwords. For more information, see Permitting IAM users to change their own passwords in the IAM User Guide.
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that IAM users in the account do not automatically have permissions to change their own password.
require_lowercase_characters : boolean_type option;Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z).
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that passwords do not require at least one lowercase character.
require_uppercase_characters : boolean_type option;Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that passwords do not require at least one uppercase character.
require_numbers : boolean_type option;Specifies whether IAM user passwords must contain at least one numeric character (0 to 9).
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that passwords do not require at least one numeric character.
require_symbols : boolean_type option;Specifies whether IAM user passwords must contain at least one of the following non-alphanumeric characters:
! @ # $ % ^ & * ( ) _ + - = [ ] { } | '
If you do not specify a value for this parameter, then the operation uses the default value of false. The result is that passwords do not require at least one symbol character.
minimum_password_length : minimum_password_length_type option;The minimum number of characters allowed in an IAM user password.
If you do not specify a value for this parameter, then the operation uses the default value of 6.
}type nonrec update_access_key_request = {status : status_type;The status you want to assign to the secret access key. Active means that the key can be used for programmatic calls to Amazon Web Services, while Inactive means that the key cannot be used.
access_key_id : access_key_id_type;The access key ID of the secret access key you want to update.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : existing_user_name_type option;The name of the user whose key you want to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_user_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified user.
*)user_name : existing_user_name_type;The name of the IAM user from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_server_certificate_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified IAM server certificate.
*)server_certificate_name : server_certificate_name_type;The name of the IAM server certificate from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_saml_provider_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified SAML identity provider.
*)saml_provider_arn : arn_type;The ARN of the SAML identity provider in IAM from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_role_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified role.
*)role_name : role_name_type;The name of the IAM role from which you want to remove tags.
This parameter accepts (through its regex pattern) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_policy_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified policy.
*)policy_arn : arn_type;The ARN of the IAM customer managed policy from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_open_id_connect_provider_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified OIDC provider.
*)open_id_connect_provider_arn : arn_type;The ARN of the OIDC provider in IAM from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_mfa_device_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified instance profile.
*)serial_number : serial_number_type;The unique identifier for the IAM virtual MFA device from which you want to remove tags. For virtual MFA devices, the serial number is the same as the ARN.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec untag_instance_profile_request = {tag_keys : tag_key_list_type;A list of key names as a simple array of strings. The tags with matching keys are removed from the specified instance profile.
*)instance_profile_name : instance_profile_name_type;The name of the IAM instance profile from which you want to remove tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tracked_action_last_accessed = {last_accessed_region : string_type option;The Region from which the authenticated entity (user or role) last attempted to access the tracked action. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)last_accessed_time : date_type option;The date and time, in ISO 8601 date-time format, when an authenticated entity most recently attempted to access the tracked service. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)last_accessed_entity : arn_type option;action_name : string_type option;The name of the tracked action to which access was attempted. Tracked actions are actions that report activity to IAM.
*)}Contains details about the most recent attempt to access an action within the service.
This data type is used as a response element in the GetServiceLastAccessedDetails operation.
type nonrec tracked_actions_last_accessed = tracked_action_last_accessed listtype nonrec tag_user_request = {user_name : existing_user_name_type;The name of the IAM user to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_server_certificate_request = {server_certificate_name : server_certificate_name_type;The name of the IAM server certificate to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_saml_provider_request = {saml_provider_arn : arn_type;The ARN of the SAML identity provider in IAM to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_role_request = {role_name : role_name_type;The name of the IAM role to which you want to add tags.
This parameter accepts (through its regex pattern) a string of characters that consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_policy_request = {policy_arn : arn_type;The ARN of the IAM customer managed policy to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_open_id_connect_provider_request = {open_id_connect_provider_arn : arn_type;The ARN of the OIDC identity provider in IAM to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_mfa_device_request = {serial_number : serial_number_type;The unique identifier for the IAM virtual MFA device to which you want to add tags. For virtual MFA devices, the serial number is the same as the ARN.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec tag_instance_profile_request = {instance_profile_name : instance_profile_name_type;The name of the IAM instance profile to which you want to add tags.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec position = {column : column_number option;The column in the line containing the specified position in the document.
*)line : line_number option;The line containing the specified position in the document.
*)}Contains the row and column of a location of a Statement element in a policy document.
This data type is used as a member of the
{{:https://docs.aws.amazon.com/IAM/latest/APIReference/API_Statement.html}Statement} type.
type nonrec statement = {end_position : position option;The row and column of the end of a Statement in an IAM policy.
start_position : position option;The row and column of the beginning of the Statement in an IAM policy.
source_policy_type : policy_source_type option;The type of the policy.
*)source_policy_id : policy_identifier_type option;The identifier of the policy that was provided as an input.
*)}Contains a reference to a Statement element in a policy document that determines the result of the simulation.
This data type is used by the MatchedStatements member of the
{{:https://docs.aws.amazon.com/IAM/latest/APIReference/API_EvaluationResult.html}EvaluationResult} type.
type nonrec statement_list_type = statement listtype nonrec simulation_policy_list_type = policy_document_type listtype nonrec action_name_list_type = action_name_type listtype nonrec resource_name_list_type = resource_name_type listtype nonrec context_key_value_list_type = context_key_value_type listtype nonrec context_entry = {context_key_type : context_key_type_enum option;The data type of the value (or values) specified in the ContextKeyValues parameter.
context_key_values : context_key_value_list_type option;The value (or values, if the condition context key supports multiple values) to provide to the simulation when the key is referenced by a Condition element in an input policy.
context_key_name : context_key_name_type option;The full name of a condition context key, including the service prefix. For example, aws:SourceIp or s3:VersionId.
}Contains information about a condition context key. It includes the name of the key and specifies the value (or values, if the context key supports multiple values) to use in the simulation. This information is used when evaluating the Condition elements of the input policies.
This data type is used as an input parameter to SimulateCustomPolicy and SimulatePrincipalPolicy.
type nonrec context_entry_list_type = context_entry listtype nonrec simulate_principal_policy_request = {marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
resource_handling_option : resource_handling_option_type option;Specifies the type of simulation to run. Different API operations that support resource-based policies require different combinations of resources. By specifying the type of simulation to run, you enable the policy simulator to enforce the presence of the required resources to ensure reliable simulation results. If your simulation does not match one of the following scenarios, then you can omit this parameter. The following list shows each of the supported scenario values and the resources that you must define to run the simulation.
Each of the Amazon EC2 scenarios requires that you specify instance, image, and security group resources. If your scenario includes an EBS volume, then you must specify that volume as a resource. If the Amazon EC2 scenario includes VPC, then you must supply the network interface resource. If it includes an IP subnet, then you must specify the subnet resource. For more information on the Amazon EC2 scenario options, see Supported platforms in the Amazon EC2 User Guide.
EC2-VPC-InstanceStore
instance, image, security group, network interface
EC2-VPC-InstanceStore-Subnet
instance, image, security group, network interface, subnet
EC2-VPC-EBS
instance, image, security group, network interface, volume
EC2-VPC-EBS-Subnet
instance, image, security group, network interface, subnet, volume
context_entries : context_entry_list_type option;A list of context keys and corresponding values for the simulation to use. Whenever a context key is evaluated in one of the simulated IAM permissions policies, the corresponding value is supplied.
*)caller_arn : resource_name_type option;The ARN of the IAM user that you want to specify as the simulated caller of the API operations. If you do not specify a CallerArn, it defaults to the ARN of the user that you specify in PolicySourceArn, if you specified a user. If you include both a PolicySourceArn (for example, arn:aws:iam::123456789012:user/David) and a CallerArn (for example, arn:aws:iam::123456789012:user/Bob), the result is that you simulate calling the API operations as Bob, as if Bob had David's policies.
You can specify only the ARN of an IAM user. You cannot specify the ARN of an assumed role, federated user, or a service principal.
CallerArn is required if you include a ResourcePolicy and the PolicySourceArn is not the ARN for an IAM user. This is required so that the resource-based policy's Principal element has a value to use in evaluating the policy.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)resource_owner : resource_name_type option;An Amazon Web Services account ID that specifies the owner of any simulated resource that does not identify its owner in the resource ARN. Examples of resource ARNs include an S3 bucket or object. If ResourceOwner is specified, it is also used as the account owner of any ResourcePolicy included in the simulation. If the ResourceOwner parameter is not specified, then the owner of the resources and the resource policy defaults to the account of the identity provided in CallerArn. This parameter is required only if you specify a resource-based policy and account that owns the resource is different from the account that owns the simulated calling user CallerArn.
resource_policy : policy_document_type option;A resource-based policy to include in the simulation provided as a string. Each resource in the simulation is treated as if it had this policy attached. You can include only one resource-based policy in a simulation.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)Simulation of resource-based policies isn't supported for IAM roles.
*)resource_arns : resource_name_list_type option;A list of ARNs of Amazon Web Services resources to include in the simulation. If this parameter is not provided, then the value defaults to * (all resources). Each API in the ActionNames parameter is evaluated for each resource in this list. The simulation determines the access result (allowed or denied) of each combination and reports it in the response. You can simulate resources that don't exist in your account.
The simulation does not automatically retrieve policies for the specified resources. If you want to include a resource policy in the simulation, then you must include the policy as a string in the ResourcePolicy parameter.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
Simulation of resource-based policies isn't supported for IAM roles.
*)action_names : action_name_list_type;A list of names of API operations to evaluate in the simulation. Each operation is evaluated for each resource. Each operation must include the service identifier, such as iam:CreateUser.
permissions_boundary_policy_input_list : simulation_policy_list_type option;The IAM permissions boundary policy to simulate. The permissions boundary sets the maximum permissions that the entity can have. You can input only one permissions boundary when you pass a policy to this operation. An IAM entity can only have one permissions boundary in effect at a time. For example, if a permissions boundary is attached to an entity and you pass in a different permissions boundary policy using this parameter, then the new permissions boundary policy is used for the simulation. For more information about permissions boundaries, see Permissions boundaries for IAM entities in the IAM User Guide. The policy input is specified as a string containing the complete, valid JSON text of a permissions boundary policy.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_input_list : simulation_policy_list_type option;An optional list of additional policy documents to include in the simulation. Each document is specified as a string containing the complete, valid JSON text of an IAM policy.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_source_arn : arn_type;The Amazon Resource Name (ARN) of a user, group, or role whose policies you want to include in the simulation. If you specify a user, group, or role, the simulation includes all policies that are associated with that entity. If you specify a user, the simulation also includes all policies that are attached to any groups the user belongs to.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}The request failed because a provided policy could not be successfully evaluated. An additional detailed message indicates the source of the failure.
type nonrec context_key_names_result_list_type = context_key_name_type listtype nonrec organizations_decision_detail = {allowed_by_organizations : boolean_type option;Specifies whether the simulated operation is allowed by the Organizations service control policies that impact the simulated user's account.
*)}Contains information about the effect that Organizations has on a policy simulation.
type nonrec permissions_boundary_decision_detail = {allowed_by_permissions_boundary : boolean_type option;Specifies whether an action is allowed by a permissions boundary that is applied to an IAM entity (user or role). A value of true means that the permissions boundary does not deny the action. This means that the policy includes an Allow statement that matches the request. In this case, if an identity-based policy also allows the action, the request is allowed. A value of false means that either the requested action is not allowed (implicitly denied) or that the action is explicitly denied by the permissions boundary. In both of these cases, the action is not allowed, regardless of the identity-based policy.
}Contains information about the effect that a permissions boundary has on a policy simulation when the boundary is applied to an IAM entity.
type nonrec eval_decision_details_type =
(eval_decision_source_type * policy_evaluation_decision_type) listtype nonrec resource_specific_result = {permissions_boundary_decision_detail : permissions_boundary_decision_detail
option;Contains information about the effect that a permissions boundary has on a policy simulation when that boundary is applied to an IAM entity.
*)eval_decision_details : eval_decision_details_type option;Additional details about the results of the evaluation decision on a single resource. This parameter is returned only for cross-account simulations. This parameter explains how each policy type contributes to the resource-specific evaluation decision.
*)missing_context_values : context_key_names_result_list_type option;A list of context keys that are required by the included input policies but that were not provided by one of the input parameters. This list is used when a list of ARNs is included in the ResourceArns parameter instead of "*". If you do not specify individual resources, by setting ResourceArns to "*" or by not including the ResourceArns parameter, then any missing context values are instead included under the EvaluationResults section. To discover the context keys used by a set of policies, you can call GetContextKeysForCustomPolicy or GetContextKeysForPrincipalPolicy.
matched_statements : statement_list_type option;A list of the statements in the input policies that determine the result for this part of the simulation. Remember that even if multiple statements allow the operation on the resource, if any statement denies that operation, then the explicit deny overrides any allow. In addition, the deny statement is the only entry included in the result.
*)eval_resource_decision : policy_evaluation_decision_type;The result of the simulation of the simulated API operation on the resource specified in EvalResourceName.
eval_resource_name : resource_name_type;The name of the simulated resource, in Amazon Resource Name (ARN) format.
*)}Contains the result of the simulation of a single API operation call on a single resource.
This data type is used by a member of the EvaluationResult data type.
type nonrec resource_specific_result_list_type = resource_specific_result listtype nonrec evaluation_result = {resource_specific_results : resource_specific_result_list_type option;The individual results of the simulation of the API operation specified in EvalActionName on each resource.
*)eval_decision_details : eval_decision_details_type option;Additional details about the results of the cross-account evaluation decision. This parameter is populated for only cross-account simulations. It contains a brief summary of how each policy type contributes to the final evaluation decision.
If the simulation evaluates policies within the same account and includes a resource ARN, then the parameter is present but the response is empty. If the simulation evaluates policies within the same account and specifies all resources (*), then the parameter is not returned.
When you make a cross-account request, Amazon Web Services evaluates the request in the trusting account and the trusted account. The request is allowed only if both evaluations return true. For more information about how policies are evaluated, see Evaluating policies within a single account.
If an Organizations SCP included in the evaluation denies access, the simulation ends. In this case, policy evaluation does not proceed any further and this parameter is not returned.
*)permissions_boundary_decision_detail : permissions_boundary_decision_detail
option;Contains information about the effect that a permissions boundary has on a policy simulation when the boundary is applied to an IAM entity.
*)organizations_decision_detail : organizations_decision_detail option;A structure that details how Organizations and its service control policies affect the results of the simulation. Only applies if the simulated user's account is part of an organization.
*)missing_context_values : context_key_names_result_list_type option;A list of context keys that are required by the included input policies but that were not provided by one of the input parameters. This list is used when the resource in a simulation is "*", either explicitly, or when the ResourceArns parameter blank. If you include a list of resources, then any missing context values are instead included under the ResourceSpecificResults section. To discover the context keys used by a set of policies, you can call GetContextKeysForCustomPolicy or GetContextKeysForPrincipalPolicy.
matched_statements : statement_list_type option;A list of the statements in the input policies that determine the result for this scenario. Remember that even if multiple statements allow the operation on the resource, if only one statement denies that operation, then the explicit deny overrides any allow. In addition, the deny statement is the only entry included in the result.
*)eval_decision : policy_evaluation_decision_type;The result of the simulation.
*)eval_resource_name : resource_name_type option;The ARN of the resource that the indicated API operation was tested on.
*)eval_action_name : action_name_type;The name of the API operation tested on the indicated resource.
*)}Contains the results of a simulation.
This data type is used by the return parameter of
{{:https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulateCustomPolicy.html}SimulateCustomPolicy} and
{{:https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html}SimulatePrincipalPolicy} .
type nonrec evaluation_results_list_type = evaluation_result listtype nonrec simulate_policy_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
evaluation_results : evaluation_results_list_type option;The results of the simulation.
*)}Contains the response to a successful SimulatePrincipalPolicy or SimulateCustomPolicy request.
type nonrec simulate_custom_policy_request = {marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
resource_handling_option : resource_handling_option_type option;Specifies the type of simulation to run. Different API operations that support resource-based policies require different combinations of resources. By specifying the type of simulation to run, you enable the policy simulator to enforce the presence of the required resources to ensure reliable simulation results. If your simulation does not match one of the following scenarios, then you can omit this parameter. The following list shows each of the supported scenario values and the resources that you must define to run the simulation.
Each of the Amazon EC2 scenarios requires that you specify instance, image, and security group resources. If your scenario includes an EBS volume, then you must specify that volume as a resource. If the Amazon EC2 scenario includes VPC, then you must supply the network interface resource. If it includes an IP subnet, then you must specify the subnet resource. For more information on the Amazon EC2 scenario options, see Supported platforms in the Amazon EC2 User Guide.
EC2-VPC-InstanceStore
instance, image, security group, network interface
EC2-VPC-InstanceStore-Subnet
instance, image, security group, network interface, subnet
EC2-VPC-EBS
instance, image, security group, network interface, volume
EC2-VPC-EBS-Subnet
instance, image, security group, network interface, subnet, volume
context_entries : context_entry_list_type option;A list of context keys and corresponding values for the simulation to use. Whenever a context key is evaluated in one of the simulated IAM permissions policies, the corresponding value is supplied.
*)caller_arn : resource_name_type option;The ARN of the IAM user that you want to use as the simulated caller of the API operations. CallerArn is required if you include a ResourcePolicy so that the policy's Principal element has a value to use in evaluating the policy.
You can specify only the ARN of an IAM user. You cannot specify the ARN of an assumed role, federated user, or a service principal.
*)resource_owner : resource_name_type option;An ARN representing the Amazon Web Services account ID that specifies the owner of any simulated resource that does not identify its owner in the resource ARN. Examples of resource ARNs include an S3 bucket or object. If ResourceOwner is specified, it is also used as the account owner of any ResourcePolicy included in the simulation. If the ResourceOwner parameter is not specified, then the owner of the resources and the resource policy defaults to the account of the identity provided in CallerArn. This parameter is required only if you specify a resource-based policy and account that owns the resource is different from the account that owns the simulated calling user CallerArn.
The ARN for an account uses the following syntax:
arn:aws:iam::{i AWS-account-ID}:root. For example, to represent the account with the 112233445566 ID, use the following ARN: arn:aws:iam::112233445566-ID:root.
resource_policy : policy_document_type option;A resource-based policy to include in the simulation provided as a string. Each resource in the simulation is treated as if it had this policy attached. You can include only one resource-based policy in a simulation.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)Simulation of resource-based policies isn't supported for IAM roles.
*)resource_arns : resource_name_list_type option;A list of ARNs of Amazon Web Services resources to include in the simulation. If this parameter is not provided, then the value defaults to * (all resources). Each API in the ActionNames parameter is evaluated for each resource in this list. The simulation determines the access result (allowed or denied) of each combination and reports it in the response. You can simulate resources that don't exist in your account.
The simulation does not automatically retrieve policies for the specified resources. If you want to include a resource policy in the simulation, then you must include the policy as a string in the ResourcePolicy parameter.
If you include a ResourcePolicy, then it must be applicable to all of the resources included in the simulation or you receive an invalid input error.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
Simulation of resource-based policies isn't supported for IAM roles.
*)action_names : action_name_list_type;A list of names of API operations to evaluate in the simulation. Each operation is evaluated against each resource. Each operation must include the service identifier, such as iam:CreateUser. This operation does not support using wildcards (*) in an action name.
permissions_boundary_policy_input_list : simulation_policy_list_type option;The IAM permissions boundary policy to simulate. The permissions boundary sets the maximum permissions that an IAM entity can have. You can input only one permissions boundary when you pass a policy to this operation. For more information about permissions boundaries, see Permissions boundaries for IAM entities in the IAM User Guide. The policy input is specified as a string that contains the complete, valid JSON text of a permissions boundary policy.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_input_list : simulation_policy_list_type;A list of policy documents to include in the simulation. Each document is specified as a string containing the complete, valid JSON text of an IAM policy. Do not include any resource-based policies in this parameter. Any resource-based policy must be submitted with the ResourcePolicy parameter. The policies cannot be "scope-down" policies, such as you could include in a call to GetFederationToken or one of the AssumeRole API operations. In other words, do not use policies designed to restrict what a user can do while using the temporary credentials.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)}type nonrec set_security_token_service_preferences_request = {global_endpoint_token_version : global_endpoint_token_version;The version of the global endpoint token. Version 1 tokens are valid only in Amazon Web Services Regions that are available by default. These tokens do not work in manually enabled Regions, such as Asia Pacific (Hong Kong). Version 2 tokens are valid in all Regions. However, version 2 tokens are longer and might affect systems where you temporarily store tokens.
For information, see Activating and deactivating STS in an Amazon Web Services Region in the IAM User Guide.
*)}type nonrec set_default_policy_version_request = {version_id : policy_version_id_type;The version of the policy to set as the default (operative) version.
For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
*)policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy whose default version you want to set.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec service_last_accessed = {tracked_actions_last_accessed : tracked_actions_last_accessed option;An object that contains details about the most recent attempt to access a tracked action within the service.
This field is null if there no tracked actions or if the principal did not use the tracked actions within the tracking period. This field is also null if the report was generated at the service level and not the action level. For more information, see the Granularity field in GenerateServiceLastAccessedDetails.
total_authenticated_entities : integer_type option;The total number of authenticated principals (root user, IAM users, or IAM roles) that have attempted to access the service.
This field is null if no principals attempted to access the service within the tracking period.
*)last_authenticated_region : string_type option;The Region from which the authenticated entity (user or role) last attempted to access the service. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)last_authenticated_entity : arn_type option;The ARN of the authenticated entity (user or role) that last attempted to access the service. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)service_namespace : service_namespace_type;The namespace of the service in which access was attempted.
To learn the service namespace of a service, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services Service Namespaces in the Amazon Web Services General Reference.
last_authenticated : date_type option;The date and time, in ISO 8601 date-time format, when an authenticated entity most recently attempted to access the service. Amazon Web Services does not report unauthenticated requests.
This field is null if no IAM entities attempted to access the service within the tracking period.
*)service_name : service_name_type;The name of the service in which access was attempted.
*)}Contains details about the most recent attempt to access the service.
This data type is used as a response element in the GetServiceLastAccessedDetails operation.
type nonrec services_last_accessed = service_last_accessed listtype nonrec service_specific_credential_metadata = {service_name : service_name;The name of the service associated with the service-specific credential.
*)service_specific_credential_id : service_specific_credential_id;The unique identifier for the service-specific credential.
*)expiration_date : date_type option;The date and time when the service specific credential expires. This field is only present for Bedrock API keys and CloudWatch Logs API keys that were created with an expiration period.
*)create_date : date_type;The date and time, in ISO 8601 date-time format, when the service-specific credential were created.
*)service_credential_alias : service_credential_alias option;For Bedrock API keys and CloudWatch Logs API keys, this is the public portion of the credential that includes the IAM user name and a suffix containing version and creation information.
*)service_user_name : service_user_name option;The generated user name for the service-specific credential.
*)status : status_type;The status of the service-specific credential. Active means that the key is valid for API calls, while Inactive means it is not.
user_name : user_name_type;The name of the IAM user associated with the service-specific credential.
*)}Contains additional details about a service-specific credential.
type nonrec service_specific_credentials_list_type =
service_specific_credential_metadata listtype nonrec service_specific_credential = {status : status_type;The status of the service-specific credential. Active means that the key is valid for API calls, while Inactive means it is not.
user_name : user_name_type;The name of the IAM user associated with the service-specific credential.
*)service_specific_credential_id : service_specific_credential_id;The unique identifier for the service-specific credential.
*)service_credential_secret : service_credential_secret option;For Bedrock API keys and CloudWatch Logs API keys, this is the secret portion of the credential that should be used to authenticate API calls. This value is returned only when the credential is created.
*)service_credential_alias : service_credential_alias option;For Bedrock API keys and CloudWatch Logs API keys, this is the public portion of the credential that includes the IAM user name and a suffix containing version and creation information.
*)service_password : service_password option;The generated password for the service-specific credential.
*)service_user_name : service_user_name option;The generated user name for the service-specific credential. This value is generated by combining the IAM user's name combined with the ID number of the Amazon Web Services account, as in jane-at-123456789012, for example. This value cannot be configured by the user.
service_name : service_name;The name of the service associated with the service-specific credential.
*)expiration_date : date_type option;The date and time when the service specific credential expires. This field is only present for Bedrock API keys and CloudWatch Logs API keys that were created with an expiration period.
*)create_date : date_type;The date and time, in ISO 8601 date-time format, when the service-specific credential were created.
*)}Contains the details of a service-specific credential.
The specified service does not support service-specific credentials.
The request was rejected because trusted access is not enabled for IAM in Organizations. For details, see IAM and Organizations in the Organizations User Guide.
type nonrec server_certificate = {certificate_chain : certificate_chain_type option;The contents of the public key certificate chain.
*)certificate_body : certificate_body_type;The contents of the public key certificate.
*)server_certificate_metadata : server_certificate_metadata;The meta information of the server certificate, such as its name, path, ID, and ARN.
*)}Contains information about a server certificate.
This data type is used as a response element in the GetServerCertificate operation.
type nonrec send_delegation_token_request = {delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request for which to send the token.
*)}type nonrec ssh_public_key_metadata = {upload_date : date_type;status : status_type;The status of the SSH public key. Active means that the key can be used for authentication with an CodeCommit repository. Inactive means that the key cannot be used.
ssh_public_key_id : public_key_id_type;The unique identifier for the SSH public key.
*)user_name : user_name_type;The name of the IAM user associated with the SSH public key.
*)}Contains information about an SSH public key, without the key's body or fingerprint.
This data type is used as a response element in the ListSSHPublicKeys operation.
type nonrec ssh_public_key_list_type = ssh_public_key_metadata listtype nonrec saml_provider_list_entry = {create_date : date_type option;The date and time when the SAML provider was created.
*)valid_until : date_type option;The expiration date and time for the SAML provider.
*)arn : arn_type option;The Amazon Resource Name (ARN) of the SAML provider.
*)}Contains the list of SAML providers for this account.
type nonrec saml_provider_list_type = saml_provider_list_entry listtype nonrec arn_list_type = arn_type listtype nonrec role_usage_type = {resources : arn_list_type option;The name of the resource that is using the service-linked role.
*)region : region_name_type option;The name of the Region where the service-linked role is being used.
*)}An object that contains details about how a service-linked role is used, if that information is returned by the service.
This data type is used as a response element in the GetServiceLinkedRoleDeletionStatus operation.
type nonrec role_usage_list_type = role_usage_type listtype nonrec resync_mfa_device_request = {authentication_code2 : authentication_code_type;A subsequent authentication code emitted by the device.
The format for this parameter is a sequence of six digits.
*)authentication_code1 : authentication_code_type;An authentication code emitted by the device.
The format for this parameter is a sequence of six digits.
*)serial_number : serial_number_type;Serial number that uniquely identifies the MFA device.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)user_name : existing_user_name_type;The name of the user whose MFA device you want to resynchronize.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec invalid_authentication_code_exception = {message : invalid_authentication_code_message option;}The request was rejected because the authentication code was not recognized. The error message describes the specific error.
type nonrec reset_service_specific_credential_response = {service_specific_credential : service_specific_credential option;A structure with details about the updated service-specific credential, including the new password.
This is the only time that you can access the password. You cannot recover the password later, but you can reset it again.
*)}type nonrec reset_service_specific_credential_request = {service_specific_credential_id : service_specific_credential_id;The unique identifier of the service-specific credential.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type option;The name of the IAM user associated with the service-specific credential. If this value is not specified, then the operation assumes the user whose credentials are used to call the operation.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec report_generation_limit_exceeded_exception = {message : report_generation_limit_exceeded_message option;}The request failed because the maximum number of concurrent requests for this account are already running.
type nonrec remove_user_from_group_request = {user_name : existing_user_name_type;The name of the user to remove.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)group_name : group_name_type;The name of the group to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec remove_role_from_instance_profile_request = {role_name : role_name_type;The name of the role to remove.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)instance_profile_name : instance_profile_name_type;The name of the instance profile to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec remove_client_id_from_open_id_connect_provider_request = {client_i_d : client_id_type;The client ID (also known as audience) to remove from the IAM OIDC provider resource. For more information about client IDs, see CreateOpenIDConnectProvider.
*)open_id_connect_provider_arn : arn_type;The Amazon Resource Name (ARN) of the IAM OIDC provider resource to remove the client ID from. You can get a list of OIDC provider ARNs by using the ListOpenIDConnectProviders operation.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec reject_delegation_request_request = {notes : notes_type option;Optional notes explaining the reason for rejecting the delegation request.
*)delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request to reject.
*)}type nonrec put_user_policy_request = {policy_document : policy_document_type;The policy document.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_name : policy_name_type;The name of the policy document.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)user_name : existing_user_name_type;The name of the user to associate the policy with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec put_user_permissions_boundary_request = {permissions_boundary : arn_type;The ARN of the managed policy that is used to set the permissions boundary for the user.
A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.
For more information about policy types, see Policy types in the IAM User Guide.
*)user_name : user_name_type;The name (friendly name, not ARN) of the IAM user for which you want to set the permissions boundary.
*)}The request failed because Amazon Web Services service role policies can only be attached to the service-linked role for that service.
type nonrec put_role_policy_request = {policy_document : policy_document_type;The policy document.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_name : policy_name_type;The name of the policy document.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)role_name : role_name_type;The name of the role to associate the policy with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec put_role_permissions_boundary_request = {permissions_boundary : arn_type;The ARN of the managed policy that is used to set the permissions boundary for the role.
A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.
For more information about policy types, see Policy types in the IAM User Guide.
*)role_name : role_name_type;The name (friendly name, not ARN) of the IAM role for which you want to set the permissions boundary.
*)}type nonrec put_group_policy_request = {policy_document : policy_document_type;The policy document.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_name : policy_name_type;The name of the policy document.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)group_name : group_name_type;The name of the group to associate the policy with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-.
*)}type nonrec policy_user = {user_id : id_type option;The stable and unique string identifying the user. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)user_name : user_name_type option;The name (friendly name, not ARN) identifying the user.
*)}Contains information about a user that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec policy_user_list_type = policy_user listThe policy usage type that indicates whether the policy is used as a permissions policy or as the permissions boundary for an entity.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
type nonrec policy_role = {role_id : id_type option;The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)role_name : role_name_type option;The name (friendly name, not ARN) identifying the role.
*)}Contains information about a role that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec policy_role_list_type = policy_role listtype nonrec policy_group = {group_id : id_type option;The stable and unique string identifying the group. For more information about IDs, see IAM identifiers in the IAM User Guide.
*)group_name : group_name_type option;The name (friendly name, not ARN) identifying the group.
*)}Contains information about a group that a managed policy is attached to.
This data type is used as a response element in the ListEntitiesForPolicy operation.
For more information about managed policies, refer to Managed policies and inline policies in the IAM User Guide.
type nonrec policy_group_list_type = policy_group listtype nonrec password_policy = {hard_expiry : boolean_object_type option;Specifies whether IAM users are prevented from setting a new password via the Amazon Web Services Management Console after their password has expired. The IAM user cannot access the console until an administrator resets the password. IAM users with iam:ChangePassword permission and active access keys can reset their own expired console password using the CLI or API.
password_reuse_prevention : password_reuse_prevention_type option;Specifies the number of previous passwords that IAM users are prevented from reusing.
*)max_password_age : max_password_age_type option;The number of days that an IAM user password is valid.
*)expire_passwords : boolean_type option;Indicates whether passwords in the account expire. Returns true if MaxPasswordAge contains a value greater than 0. Returns false if MaxPasswordAge is 0 or not present.
allow_users_to_change_password : boolean_type option;Specifies whether IAM users are allowed to change their own password. Gives IAM users permissions to iam:ChangePassword for only their user and to the iam:GetAccountPasswordPolicy action. This option does not attach a permissions policy to each user, rather the permissions are applied at the account-level for all users by IAM.
require_lowercase_characters : boolean_type option;Specifies whether IAM user passwords must contain at least one lowercase character (a to z).
*)require_uppercase_characters : boolean_type option;Specifies whether IAM user passwords must contain at least one uppercase character (A to Z).
*)require_numbers : boolean_type option;Specifies whether IAM user passwords must contain at least one numeric character (0 to 9).
*)require_symbols : boolean_type option;Specifies whether IAM user passwords must contain at least one of the following symbols:
! @ # $ % ^ & * ( ) _ + - = [ ] { } | '
*)minimum_password_length : minimum_password_length_type option;Minimum length to require for IAM user passwords.
*)}Contains information about the account password policy.
This data type is used as a response element in the GetAccountPasswordPolicy operation.
The request was rejected because your organization does not have All features enabled. For more information, see Available feature sets in the Organizations User Guide.
The request was rejected because no organization is associated with your account.
type nonrec open_id_idp_communication_error_exception = {message : open_id_idp_communication_error_exception_message option;}The request failed because IAM cannot connect to the OpenID Connect identity provider URL.
Contains the Amazon Resource Name (ARN) for an IAM OpenID Connect provider.
type nonrec open_id_connect_provider_list_type =
open_id_connect_provider_list_entry listtype nonrec managed_policy_detail = {policy_version_list : policy_document_version_list_type option;A list containing information about the versions of the policy.
*)update_date : date_type option;The date and time, in ISO 8601 date-time format, when the policy was last updated.
When a policy has only one version, this field contains the date and time when the policy was created. When a policy has more than one version, this field contains the date and time when the most recent policy version was created.
*)create_date : date_type option;description : policy_description_type option;A friendly description of the policy.
*)is_attachable : boolean_type option;Specifies whether the policy can be attached to an IAM user, group, or role.
*)permissions_boundary_usage_count : attachment_count_type option;The number of entities (users and roles) for which the policy is used as the permissions boundary.
For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
*)attachment_count : attachment_count_type option;The number of principal entities (users, groups, and roles) that the policy is attached to.
*)default_version_id : policy_version_id_type option;The identifier for the version of the policy that is set as the default (operative) version.
For more information about policy versions, see Versioning for managed policies in the IAM User Guide.
*)path : policy_path_type option;The path to the policy.
For more information about paths, see IAM identifiers in the IAM User Guide.
*)arn : arn_type option;policy_id : id_type option;The stable and unique string identifying the policy.
For more information about IDs, see IAM identifiers in the IAM User Guide.
*)policy_name : policy_name_type option;The friendly name (not ARN) identifying the policy.
*)}Contains information about a managed policy, including the policy's ARN, versions, and the number of principal entities (users, groups, and roles) that the policy is attached to.
This data type is used as a response element in the GetAccountAuthorizationDetails operation.
For more information about managed policies, see Managed policies and inline policies in the IAM User Guide.
type nonrec managed_policy_detail_list_type = managed_policy_detail listtype nonrec login_profile = {password_reset_required : boolean_type option;Specifies whether the user is required to set a new password on next sign-in.
*)create_date : date_type;The date when the password for the user was created.
*)user_name : user_name_type;The name of the user, which can be used for signing in to the Amazon Web Services Management Console.
*)}Contains the user name and password create date for a user.
This data type is used as a response element in the CreateLoginProfile and GetLoginProfile operations.
type nonrec list_virtual_mfa_devices_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
virtual_mfa_devices : virtual_mfa_device_list_type;The list of virtual MFA devices in the current account that match the AssignmentStatus value that was passed in the request.
}Contains the response to a successful ListVirtualMFADevices request.
type nonrec list_virtual_mfa_devices_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
assignment_status : assignment_status_type option;The status (Unassigned or Assigned) of the devices to list. If you do not specify an AssignmentStatus, the operation defaults to Any, which lists both assigned and unassigned virtual MFA devices.,
}type nonrec list_users_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
users : user_list_type;A list of users.
*)}Contains the response to a successful ListUsers request.
type nonrec list_users_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : path_prefix_type option;The path prefix for filtering the results. For example: /division_abc/subdivision_xyz/, which would get all user names whose path starts with /division_abc/subdivision_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all user names. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec list_user_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policy_names : policy_name_list_type;A list of policy names.
*)}Contains the response to a successful ListUserPolicies request.
type nonrec list_user_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : existing_user_name_type;The name of the user to list policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_signing_certificates_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
certificates : certificate_list_type;A list of the user's signing certificate information.
*)}Contains the response to a successful ListSigningCertificates request.
type nonrec list_signing_certificates_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : existing_user_name_type option;The name of the IAM user whose signing certificates you want to examine.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_service_specific_credentials_response = {is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items.
*)marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
*)service_specific_credentials : service_specific_credentials_list_type option;A list of structures that each contain details about a service-specific credential.
*)}type nonrec list_service_specific_credentials_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
*)marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker from the response that you received to indicate where the next call should start.
*)all_users : all_users option;A flag indicating whether to list service specific credentials for all users. This parameter cannot be specified together with UserName. When true, returns all credentials associated with the specified service.
*)service_name : service_name option;Filters the returned results to only those for the specified Amazon Web Services service. If not specified, then Amazon Web Services returns service-specific credentials for all services.
*)user_name : user_name_type option;The name of the user whose service-specific credentials you want information about. If this value is not specified, then the operation assumes the user whose credentials are used to call the operation.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_server_certificates_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
server_certificate_metadata_list : server_certificate_metadata_list_type;A list of server certificates.
*)}Contains the response to a successful ListServerCertificates request.
type nonrec list_server_certificates_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : path_prefix_type option;The path prefix for filtering the results. For example: /company/servercerts would get all server certificates for which the path starts with /company/servercerts.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all server certificates. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec list_ssh_public_keys_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
ssh_public_keys : ssh_public_key_list_type option;A list of the SSH public keys assigned to IAM user.
*)}Contains the response to a successful ListSSHPublicKeys request.
type nonrec list_ssh_public_keys_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : user_name_type option;The name of the IAM user to list SSH public keys for. If none is specified, the UserName field is determined implicitly based on the Amazon Web Services access key used to sign the request.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_saml_providers_response = {saml_provider_list : saml_provider_list_type option;The list of SAML provider resource objects defined in IAM for this Amazon Web Services account.
*)}Contains the response to a successful ListSAMLProviders request.
type nonrec list_roles_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
roles : role_list_type;A list of roles.
*)}Contains the response to a successful ListRoles request.
type nonrec list_roles_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : path_prefix_type option;The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all roles whose path starts with /application_abc/component_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all roles. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec list_role_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policy_names : policy_name_list_type;A list of policy names.
*)}Contains the response to a successful ListRolePolicies request.
type nonrec list_role_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
role_name : role_name_type;The name of the role to list policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_policy_versions_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
versions : policy_document_version_list_type option;A list of policy versions.
For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
*)}Contains the response to a successful ListPolicyVersions request.
type nonrec list_policy_versions_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec list_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policies : policy_list_type option;A list of policies.
*)}Contains the response to a successful ListPolicies request.
type nonrec list_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
policy_usage_filter : policy_usage_type option;The policy usage method to use for filtering the results.
To list only permissions policies, set PolicyUsageFilter to PermissionsPolicy. To list only the policies used to set permissions boundaries, set the value to PermissionsBoundary.
This parameter is optional. If it is not included, all policies are returned.
*)path_prefix : policy_path_type option;The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
only_attached : boolean_type option;A flag to filter the results to only the attached policies.
When OnlyAttached is true, the returned list contains only the policies that are attached to an IAM user, group, or role. When OnlyAttached is false, or when the parameter is not included, all policies are returned.
scope : policy_scope_type option;The scope to use for filtering the results.
To list only Amazon Web Services managed policies, set Scope to AWS. To list only the customer managed policies in your Amazon Web Services account, set Scope to Local.
This parameter is optional. If it is not included, or if it is set to All, all policies are returned.
}type nonrec list_policies_granting_service_access_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policies_granting_service_access : list_policy_granting_service_access_response_list_type;A ListPoliciesGrantingServiceAccess object that contains details about the permissions policies attached to the specified identity (user, group, or role).
}type nonrec list_policies_granting_service_access_request = {service_namespaces : service_namespace_list_type;The service namespace for the Amazon Web Services services whose policies you want to list.
To learn the service namespace for a service, see Actions, resources, and condition keys for Amazon Web Services services in the IAM User Guide. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.
arn : arn_type;The ARN of the IAM identity (user, group, or role) whose policies you want to list.
*)marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
}type nonrec features_list_type = feature_type listtype nonrec list_organizations_features_response = {enabled_features : features_list_type option;Specifies the features that are currently available in your organization.
*)organization_id : organization_id_type option;The unique identifier (ID) of an organization.
*)}type nonrec account_not_management_or_delegated_administrator_exception = {message : exception_message option;}The request was rejected because the account making the request is not the management account or delegated administrator account for centralized root access.
type nonrec list_open_id_connect_providers_response = {open_id_connect_provider_list : open_id_connect_provider_list_type option;The list of IAM OIDC provider resource objects defined in the Amazon Web Services account.
*)}Contains the response to a successful ListOpenIDConnectProviders request.
type nonrec list_mfa_devices_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
mfa_devices : mfa_device_list_type;A list of MFA devices.
*)}Contains the response to a successful ListMFADevices request.
type nonrec list_mfa_devices_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : existing_user_name_type option;The name of the user whose MFA devices you want to list.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_instance_profiles_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
instance_profiles : instance_profile_list_type;A list of instance profiles.
*)}Contains the response to a successful ListInstanceProfiles request.
type nonrec list_instance_profiles_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : path_prefix_type option;The path prefix for filtering the results. For example, the prefix /application_abc/component_xyz/ gets all instance profiles whose path starts with /application_abc/component_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all instance profiles. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec list_instance_profiles_for_role_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
instance_profiles : instance_profile_list_type;A list of instance profiles.
*)}Contains the response to a successful ListInstanceProfilesForRole request.
type nonrec list_instance_profiles_for_role_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
role_name : role_name_type;The name of the role to list instance profiles for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_groups_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
groups : group_list_type;A list of groups.
*)}Contains the response to a successful ListGroups request.
type nonrec list_groups_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : path_prefix_type option;The path prefix for filtering the results. For example, the prefix /division_abc/subdivision_xyz/ gets all groups whose path starts with /division_abc/subdivision_xyz/.
This parameter is optional. If it is not included, it defaults to a slash (/), listing all groups. This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec list_groups_for_user_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
groups : group_list_type;A list of groups.
*)}Contains the response to a successful ListGroupsForUser request.
type nonrec list_groups_for_user_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : existing_user_name_type;The name of the user to list groups for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_group_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policy_names : policy_name_list_type;A list of policy names.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}Contains the response to a successful ListGroupPolicies request.
type nonrec list_group_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
group_name : group_name_type;The name of the group to list policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_entities_for_policy_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
policy_roles : policy_role_list_type option;A list of IAM roles that the policy is attached to.
*)policy_users : policy_user_list_type option;A list of IAM users that the policy is attached to.
*)policy_groups : policy_group_list_type option;A list of IAM groups that the policy is attached to.
*)}Contains the response to a successful ListEntitiesForPolicy request.
type nonrec list_entities_for_policy_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
policy_usage_filter : policy_usage_type option;The policy usage method to use for filtering the results.
To list only permissions policies, set PolicyUsageFilter to PermissionsPolicy. To list only the policies used to set permissions boundaries, set the value to PermissionsBoundary.
This parameter is optional. If it is not included, all policies are returned.
*)path_prefix : path_type option;The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all entities.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
entity_filter : entity_type option;The entity type to use for filtering the results.
For example, when EntityFilter is Role, only the roles that are attached to the specified policy are returned. This parameter is optional. If it is not included, all attached entities (users, groups, and roles) are returned. The argument for this parameter must be one of the valid values listed below.
policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec list_delegation_requests_response = {is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items.
marker : marker_type option;When isTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
delegation_requests : delegation_requests_list_type option;A list of delegation requests that match the specified criteria.
*)}type nonrec list_delegation_requests_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM may return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
owner_id : owner_id_type option;The owner ID to filter delegation requests by.
*)}type nonrec list_attached_user_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
attached_policies : attached_policies_list_type option;A list of the attached policies.
*)}Contains the response to a successful ListAttachedUserPolicies request.
type nonrec list_attached_user_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : policy_path_type option;The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
user_name : user_name_type;The name (friendly name, not ARN) of the user to list attached policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_attached_role_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
attached_policies : attached_policies_list_type option;A list of the attached policies.
*)}Contains the response to a successful ListAttachedRolePolicies request.
type nonrec list_attached_role_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : policy_path_type option;The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
role_name : role_name_type;The name (friendly name, not ARN) of the role to list attached policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_attached_group_policies_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
attached_policies : attached_policies_list_type option;A list of the attached policies.
*)}Contains the response to a successful ListAttachedGroupPolicies request.
type nonrec list_attached_group_policies_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
path_prefix : policy_path_type option;The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all policies.
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
group_name : group_name_type;The name (friendly name, not ARN) of the group to list attached policies for.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec list_account_aliases_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
account_aliases : account_alias_list_type;A list of aliases associated with the account. Amazon Web Services supports only one alias per account.
*)}Contains the response to a successful ListAccountAliases request.
type nonrec list_account_aliases_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
}type nonrec list_access_keys_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
access_key_metadata : access_key_metadata_list_type;A list of objects containing metadata about the access keys.
*)}Contains the response to a successful ListAccessKeys request.
type nonrec list_access_keys_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
user_name : existing_user_name_type option;The name of the user.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}The request was rejected because the type of user for the transaction was incorrect.
type nonrec get_user_response = {user : user;A structure containing details about the IAM user.
Due to a service issue, password last used data does not include password use from May 3, 2018 22:50 PDT to May 23, 2018 14:08 PDT. This affects last sign-in dates shown in the IAM console and password last used dates in the IAM credential report, and returned by this operation. If users signed in during the affected time, the password last used date that is returned is the date the user last signed in before May 3, 2018. For users that signed in after May 23, 2018 14:08 PDT, the returned password last used date is accurate.
You can use password last used information to identify unused credentials for deletion. For example, you might delete users who did not sign in to Amazon Web Services in the last 90 days. In cases like this, we recommend that you adjust your evaluation window to include dates after May 23, 2018. Alternatively, if your users use access keys to access Amazon Web Services programmatically you can refer to access key last used information because it is accurate for all dates.
*)}Contains the response to a successful GetUser request.
type nonrec get_user_request = {user_name : existing_user_name_type option;The name of the user to get information about.
This parameter is optional. If it is not included, it defaults to the user making the request. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_user_policy_response = {policy_document : policy_document_type;The policy document.
IAM stores policies in JSON format. However, resources that were created using CloudFormation templates can be formatted in YAML. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
*)policy_name : policy_name_type;The name of the policy.
*)user_name : existing_user_name_type;The user the policy is associated with.
*)}Contains the response to a successful GetUserPolicy request.
type nonrec get_user_policy_request = {policy_name : policy_name_type;The name of the policy document to get.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)user_name : existing_user_name_type;The name of the user who the policy is associated with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec deletion_task_failure_reason_type = {role_usage_list : role_usage_list_type option;A list of objects that contains details about the service-linked role deletion failure, if that information is returned by the service. If the service-linked role has active sessions or if any resources that were used by the role have not been deleted from the linked service, the role can't be deleted. This parameter includes a list of the resources that are associated with the role and the Region in which the resources are being used.
*)reason : reason_type option;A short description of the reason that the service-linked role deletion failed.
*)}The reason that the service-linked role deletion failed.
This data type is used as a response element in the GetServiceLinkedRoleDeletionStatus operation.
type nonrec get_service_linked_role_deletion_status_response = {reason : deletion_task_failure_reason_type option;An object that contains details about the reason the deletion failed.
*)status : deletion_task_status_type;The status of the deletion.
*)}type nonrec get_service_linked_role_deletion_status_request = {deletion_task_id : deletion_task_id_type;The deletion task identifier. This identifier is returned by the DeleteServiceLinkedRole operation in the format
task/aws-service-role///.
*)}type nonrec error_details = {code : string_type;The error code associated with the operation failure.
*)message : string_type;Detailed information about the reason that the operation failed.
*)}Contains information about the reason that the operation failed.
This data type is used as a response element in the GetOrganizationsAccessReport, GetServiceLastAccessedDetails, and GetServiceLastAccessedDetailsWithEntities operations.
type nonrec get_service_last_accessed_details_with_entities_response = {error : error_details option;An object that contains details about the reason the operation failed.
*)marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
entity_details_list : entity_details_list_type;An EntityDetailsList object that contains details about when an IAM entity (user or role) used group or policy permissions in an attempt to access the specified Amazon Web Services service.
job_completion_date : date_type;The date and time, in ISO 8601 date-time format, when the generated report job was completed or failed.
This field is null if the job is still in progress, as indicated by a job status value of IN_PROGRESS.
job_creation_date : date_type;job_status : job_status_type;The status of the job.
*)}type nonrec get_service_last_accessed_details_with_entities_request = {marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
service_namespace : service_namespace_type;The service namespace for an Amazon Web Services service. Provide the service namespace to learn when the IAM entity last attempted to access the specified service.
To learn the service namespace for a service, see Actions, resources, and condition keys for Amazon Web Services services in the IAM User Guide. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.
job_id : job_id_type;The ID of the request generated by the GenerateServiceLastAccessedDetails operation.
}type nonrec get_service_last_accessed_details_response = {error : error_details option;An object that contains details about the reason the operation failed.
*)marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
job_completion_date : date_type;The date and time, in ISO 8601 date-time format, when the generated report job was completed or failed.
This field is null if the job is still in progress, as indicated by a job status value of IN_PROGRESS.
services_last_accessed : services_last_accessed;A ServiceLastAccessed object that contains details about the most recent attempt to access the service.
job_creation_date : date_type;job_type : access_advisor_usage_granularity_type option;The type of job. Service jobs return information about when each service was last accessed. Action jobs also include information about when tracked actions within the service were last accessed.
*)job_status : job_status_type;The status of the job.
*)}type nonrec get_service_last_accessed_details_request = {marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
job_id : job_id_type;The ID of the request generated by the GenerateServiceLastAccessedDetails operation. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.
}type nonrec get_server_certificate_response = {server_certificate : server_certificate;A structure containing details about the server certificate.
*)}Contains the response to a successful GetServerCertificate request.
type nonrec get_server_certificate_request = {server_certificate_name : server_certificate_name_type;The name of the server certificate you want to retrieve information about.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_ssh_public_key_response = {ssh_public_key : ssh_public_key option;A structure containing details about the SSH public key.
*)}Contains the response to a successful GetSSHPublicKey request.
type nonrec get_ssh_public_key_request = {encoding : encoding_type;Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use SSH. To retrieve the public key in PEM format, use PEM.
ssh_public_key_id : public_key_id_type;The unique identifier for the SSH public key.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type;The name of the IAM user associated with the SSH public key.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_saml_provider_response = {private_key_list : private_key_list option;The private key metadata for the SAML provider.
*)assertion_encryption_mode : assertion_encryption_mode_type option;Specifies the encryption setting for the SAML provider.
*)valid_until : date_type option;The expiration date and time for the SAML provider.
*)create_date : date_type option;The date and time when the SAML provider was created.
*)saml_metadata_document : saml_metadata_document_type option;The XML metadata document that includes information about an identity provider.
*)saml_provider_uui_d : private_key_id_type option;The unique identifier assigned to the SAML provider.
*)}Contains the response to a successful GetSAMLProvider request.
type nonrec get_saml_provider_request = {saml_provider_arn : arn_type;The Amazon Resource Name (ARN) of the SAML provider resource object in IAM to get information about.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec get_role_response = {role : role;A structure containing details about the IAM role.
*)}Contains the response to a successful GetRole request.
type nonrec get_role_request = {role_name : role_name_type;The name of the IAM role to get information about.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_role_policy_response = {policy_document : policy_document_type;The policy document.
IAM stores policies in JSON format. However, resources that were created using CloudFormation templates can be formatted in YAML. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
*)policy_name : policy_name_type;The name of the policy.
*)role_name : role_name_type;The role the policy is associated with.
*)}Contains the response to a successful GetRolePolicy request.
type nonrec get_role_policy_request = {policy_name : policy_name_type;The name of the policy document to get.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)role_name : role_name_type;The name of the role associated with the policy.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_policy_version_response = {policy_version : policy_version option;A structure containing details about the policy version.
*)}Contains the response to a successful GetPolicyVersion request.
type nonrec get_policy_version_request = {version_id : policy_version_id_type;Identifies the policy version to retrieve.
This parameter allows (through its regex pattern) a string of characters that consists of the lowercase letter 'v' followed by one or two digits, and optionally followed by a period '.' and a string of letters and digits.
*)policy_arn : arn_type;The Amazon Resource Name (ARN) of the managed policy that you want information about.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec get_policy_response = {policy : policy option;A structure containing details about the policy.
*)}Contains the response to a successful GetPolicy request.
type nonrec get_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the managed policy that you want information about.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec get_outbound_web_identity_federation_info_response = {jwt_vending_enabled : boolean_type option;Indicates whether outbound identity federation is currently enabled for your Amazon Web Services account. When true, IAM principals in the account can call the GetWebIdentityToken API to obtain JSON Web Tokens (JWTs) for authentication with external services.
issuer_identifier : string_type option;A unique issuer URL for your Amazon Web Services account that hosts the OpenID Connect (OIDC) discovery endpoints at /.well-known/openid-configuration and /.well-known/jwks.json. The OpenID Connect (OIDC) discovery endpoints contain verification keys and metadata necessary for token verification.
}The request failed because outbound identity federation is already disabled for your Amazon Web Services account. You cannot disable the feature multiple times
type nonrec access_detail = {total_authenticated_entities : integer_type option;The number of accounts with authenticated principals (root user, IAM users, and IAM roles) that attempted to access the service in the tracking period.
*)last_authenticated_time : date_type option;The date and time, in ISO 8601 date-time format, when an authenticated principal most recently attempted to access the service. Amazon Web Services does not report unauthenticated requests.
This field is null if no principals in the reported Organizations entity attempted to access the service within the tracking period.
*)entity_path : organizations_entity_path_type option;The path of the Organizations entity (root, organizational unit, or account) from which an authenticated principal last attempted to access the service. Amazon Web Services does not report unauthenticated requests.
This field is null if no principals (IAM users, IAM roles, or root user) in the reported Organizations entity attempted to access the service within the tracking period.
*)region : string_type option;The Region where the last service access attempt occurred.
This field is null if no principals in the reported Organizations entity attempted to access the service within the tracking period.
*)service_namespace : service_namespace_type;The namespace of the service in which access was attempted.
To learn the service namespace of a service, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.
service_name : service_name_type;The name of the service in which access was attempted.
*)}An object that contains details about when a principal in the reported Organizations entity last attempted to access an Amazon Web Services service. A principal can be an IAM user, an IAM role, or the Amazon Web Services account root user within the reported Organizations entity.
This data type is a response element in the GetOrganizationsAccessReport operation.
type nonrec access_details = access_detail listtype nonrec get_organizations_access_report_response = {error_details : error_details option;marker : marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
access_details : access_details option;An object that contains details about the most recent attempt to access the service.
*)number_of_services_not_accessed : integer_type option;The number of services that account principals are allowed but did not attempt to access.
*)number_of_services_accessible : integer_type option;The number of services that the applicable SCPs allow account principals to access.
*)job_completion_date : date_type option;The date and time, in ISO 8601 date-time format, when the generated report job was completed or failed.
This field is null if the job is still in progress, as indicated by a job status value of IN_PROGRESS.
job_creation_date : date_type;job_status : job_status_type;The status of the job.
*)}type nonrec get_organizations_access_report_request = {sort_key : sort_key_type option;The key that is used to sort the results. If you choose the namespace key, the results are returned in alphabetical order. If you choose the time key, the results are sorted numerically by the date and time.
*)marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
job_id : job_id_type;}type nonrec get_open_id_connect_provider_response = {create_date : date_type option;The date and time when the IAM OIDC provider resource object was created in the Amazon Web Services account.
*)thumbprint_list : thumbprint_list_type option;A list of certificate thumbprints that are associated with the specified IAM OIDC provider resource object. For more information, see CreateOpenIDConnectProvider.
*)client_id_list : client_id_list_type option;A list of client IDs (also known as audiences) that are associated with the specified IAM OIDC provider resource object. For more information, see CreateOpenIDConnectProvider.
*)url : open_id_connect_provider_url_type option;The URL that the IAM OIDC provider resource object is associated with. For more information, see CreateOpenIDConnectProvider.
*)}Contains the response to a successful GetOpenIDConnectProvider request.
type nonrec get_open_id_connect_provider_request = {open_id_connect_provider_arn : arn_type;The Amazon Resource Name (ARN) of the OIDC provider resource object in IAM to get information for. You can get a list of OIDC provider resource ARNs by using the ListOpenIDConnectProviders operation.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec certification_map_type =
(certification_key_type * certification_value_type) listtype nonrec get_mfa_device_response = {certifications : certification_map_type option;The certifications of a specified user's MFA device. We currently provide FIPS-140-2, FIPS-140-3, and FIDO certification levels obtained from FIDO Alliance Metadata Service (MDS).
*)enable_date : date_type option;The date that a specified user's MFA device was first enabled.
*)serial_number : serial_number_type;Serial number that uniquely identifies the MFA device. For this API, we only accept FIDO security key ARNs.
*)user_name : user_name_type option;The friendly name identifying the user.
*)}type nonrec get_mfa_device_request = {user_name : user_name_type option;The friendly name identifying the user.
*)serial_number : serial_number_type;Serial number that uniquely identifies the MFA device. For this API, we only accept FIDO security key ARNs.
*)}type nonrec get_login_profile_response = {login_profile : login_profile;A structure containing the user name and the profile creation date for the user.
*)}Contains the response to a successful GetLoginProfile request.
type nonrec get_login_profile_request = {user_name : user_name_type option;The name of the user whose login profile you want to retrieve.
This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_instance_profile_response = {instance_profile : instance_profile;A structure containing details about the instance profile.
*)}Contains the response to a successful GetInstanceProfile request.
type nonrec get_instance_profile_request = {instance_profile_name : instance_profile_name_type;The name of the instance profile to get information about.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_human_readable_summary_response = {summary_state : summary_state_type option;State of summary generation. This generation process is asynchronous and this attribute indicates the state of the generation process.
*)locale : locale_type option;The locale that this response was generated for. This maps to the input locale.
*)summary_content : summary_content_type option;Summary content in the specified locale. Summary content is non-empty only if the SummaryState is AVAILABLE.
}type nonrec get_human_readable_summary_request = {locale : locale_type option;A string representing the locale to use for the summary generation. The supported locale strings are based on the Supported languages of the Amazon Web Services Management Console.
*)entity_arn : arn_type;Arn of the entity to be summarized. At this time, the only supported entity type is delegation-request
}type nonrec get_group_response = {marker : response_marker_type option;When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.
is_truncated : boolean_type option;A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. Note that IAM might return fewer than the MaxItems number of results even when there are more results available. We recommend that you check IsTruncated after every call to ensure that you receive all your results.
users : user_list_type;A list of users in the group.
*)group : group;A structure that contains details about the group.
*)}Contains the response to a successful GetGroup request.
type nonrec get_group_request = {max_items : max_items_type option;Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
If you do not include this parameter, the number of items defaults to 100. Note that IAM might return fewer results, even when there are more results available. In that case, the IsTruncated response element returns true, and Marker contains a value to include in the subsequent call that tells the service where to continue from.
marker : marker_type option;Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker element in the response that you received to indicate where the next call should start.
group_name : group_name_type;The name of the group.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_group_policy_response = {policy_document : policy_document_type;The policy document.
IAM stores policies in JSON format. However, resources that were created using CloudFormation templates can be formatted in YAML. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
*)policy_name : policy_name_type;The name of the policy.
*)group_name : group_name_type;The group the policy is associated with.
*)}Contains the response to a successful GetGroupPolicy request.
type nonrec get_group_policy_request = {policy_name : policy_name_type;The name of the policy document to get.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)group_name : group_name_type;The name of the group the policy is associated with.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec get_delegation_request_response = {permission_check_result : permission_check_result_type option;The result of the permission check, indicating whether the caller has sufficient permissions to cover the requested permissions. This is an approximate result.
ALLOWED : The caller has sufficient permissions cover all the requested permissions.DENIED : The caller does not have sufficient permissions to cover all the requested permissions.UNSURE : It is not possible to determine whether the caller has all the permissions needed. This output is most likely for cases when the caller has permissions with conditions.permission_check_status : permission_check_status_type option;The status of the permission check for the delegation request.
This value indicates the status of the process to check whether the caller has sufficient permissions to cover the requested actions in the delegation request. Since this is an asynchronous process, there are three potential values:
IN_PROGRESS : The permission check process has started.COMPLETED : The permission check process has completed. The PermissionCheckResult will include the result.FAILED : The permission check process has failed.delegation_request : delegation_request option;The delegation request object containing all details about the request.
*)}type nonrec get_delegation_request_request = {delegation_permission_check : boolean_type option;Specifies whether to perform a permission check for the delegation request.
If set to true, the GetDelegationRequest API call will start a permission check process. This process calculates whether the caller has sufficient permissions to cover the asks from this delegation request.
Setting this parameter to true does not guarantee an answer in the response. See the PermissionCheckStatus and the PermissionCheckResult response attributes for further details.
delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request to retrieve.
*)}type nonrec get_credential_report_response = {generated_time : date_type option;report_format : report_format_type option;The format (MIME type) of the credential report.
*)content : report_content_type option;Contains the credential report. The report is Base64-encoded.
*)}Contains the response to a successful GetCredentialReport request.
type nonrec credential_report_not_ready_exception = {message : credential_report_not_ready_exception_message option;}The request was rejected because the credential report is still being generated.
type nonrec credential_report_not_present_exception = {message : credential_report_not_present_exception_message option;}The request was rejected because the credential report does not exist. To generate a credential report, use GenerateCredentialReport.
type nonrec credential_report_expired_exception = {message : credential_report_expired_exception_message option;}The request was rejected because the most recent credential report has expired. To generate a new credential report, use GenerateCredentialReport. For more information about credential report expiration, see Getting credential reports in the IAM User Guide.
type nonrec get_context_keys_for_principal_policy_request = {policy_input_list : simulation_policy_list_type option;An optional list of additional policies for which you want the list of context keys that are referenced.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_source_arn : arn_type;The ARN of a user, group, or role whose policies contain the context keys that you want listed. If you specify a user, the list includes context keys that are found in all policies that are attached to the user. The list also includes all groups that the user is a member of. If you pick a group or a role, then it includes only those context keys that are found in policies attached to that entity. Note that all parameters are shown in unencoded form here for clarity, but must be URL encoded to be included as a part of a real HTML request.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec get_context_keys_for_policy_response = {context_key_names : context_key_names_result_list_type option;The list of context keys that are referenced in the input policies.
*)}Contains the response to a successful GetContextKeysForPrincipalPolicy or GetContextKeysForCustomPolicy request.
type nonrec get_context_keys_for_custom_policy_request = {policy_input_list : simulation_policy_list_type;A list of policies for which you want the list of context keys referenced in those policies. Each document is specified as a string containing the complete, valid JSON text of an IAM policy.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)}type nonrec get_account_summary_response = {summary_map : summary_map_type option;A set of key–value pairs containing information about IAM entity usage and IAM quotas.
*)}Contains the response to a successful GetAccountSummary request.
type nonrec get_account_password_policy_response = {password_policy : password_policy;A structure that contains details about the account's password policy.
*)}Contains the response to a successful GetAccountPasswordPolicy request.
Contains the response to a successful GetAccountAuthorizationDetails request.
type nonrec access_key_last_used = {region : string_type;The Amazon Web Services Region where this access key was most recently used. The value for this field is "N/A" in the following situations:
For more information about Amazon Web Services Regions, see Regions and endpoints in the Amazon Web Services General Reference.
*)service_name : string_type;The name of the Amazon Web Services service with which this access key was most recently used. The value of this field is "N/A" in the following situations:
last_used_date : date_type option;The date and time, in ISO 8601 date-time format, when the access key was most recently used. This field is null in the following situations:
}Contains information about the last time an Amazon Web Services access key was used since IAM began tracking this information on April 22, 2015.
This data type is used as a response element in the GetAccessKeyLastUsed operation.
type nonrec get_access_key_last_used_response = {access_key_last_used : access_key_last_used option;Contains information about the last time the access key was used.
*)user_name : existing_user_name_type option;The name of the IAM user that owns this access key.
*)}Contains the response to a successful GetAccessKeyLastUsed request. It is also returned as a member of the AccessKeyMetaData structure returned by the ListAccessKeys action.
type nonrec get_access_key_last_used_request = {access_key_id : access_key_id_type;The identifier of an access key.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)}type nonrec generate_service_last_accessed_details_response = {job_id : job_id_type option;The JobId that you can use in the GetServiceLastAccessedDetails or GetServiceLastAccessedDetailsWithEntities operations. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.
}type nonrec generate_service_last_accessed_details_request = {granularity : access_advisor_usage_granularity_type option;The level of detail that you want to generate. You can specify whether you want to generate information about the last attempt to access services or actions. If you specify service-level granularity, this operation generates only service data. If you specify action-level granularity, it generates service and action data. If you don't include this optional parameter, the operation generates service data.
*)arn : arn_type;The ARN of the IAM resource (user, group, role, or managed policy) used to generate information about when the resource was last used in an attempt to access an Amazon Web Services service.
*)}type nonrec generate_organizations_access_report_request = {organizations_policy_id : organizations_policy_id_type option;The identifier of the Organizations service control policy (SCP). This parameter is optional.
This ID is used to generate information about when an account principal that is limited by the SCP attempted to access an Amazon Web Services service.
*)entity_path : organizations_entity_path_type;The path of the Organizations entity (root, OU, or account). You can build an entity path using the known structure of your organization. For example, assume that your account ID is 123456789012 and its parent OU ID is ou-rge0-awsabcde. The organization root ID is r-f6g7h8i9j0example and your organization ID is o-a1b2c3d4e5. Your entity path is o-a1b2c3d4e5/r-f6g7h8i9j0example/ou-rge0-awsabcde/123456789012.
}type nonrec generate_credential_report_response = {description : report_state_description_type option;Information about the credential report.
*)state : report_state_type option;Information about the state of the credential report.
*)}Contains the response to a successful GenerateCredentialReport request.
The request failed because outbound identity federation is already enabled for your Amazon Web Services account. You cannot enable the feature multiple times. To fetch the current configuration (including the unique issuer URL), use the GetOutboundWebIdentityFederationInfo operation.
type nonrec enable_outbound_web_identity_federation_response = {issuer_identifier : string_type option;A unique issuer URL for your Amazon Web Services account that hosts the OpenID Connect (OIDC) discovery endpoints at /.well-known/openid-configuration and /.well-known/jwks.json. The OpenID Connect (OIDC) discovery endpoints contain verification keys and metadata necessary for token verification.
}type nonrec enable_organizations_root_sessions_response = {enabled_features : features_list_type option;The features you have enabled for centralized root access.
*)organization_id : organization_id_type option;The unique identifier (ID) of an organization.
*)}The request was rejected because the account making the request is not the management account for the organization.
type nonrec enable_organizations_root_credentials_management_response = {enabled_features : features_list_type option;The features you have enabled for centralized root access.
*)organization_id : organization_id_type option;The unique identifier (ID) of an organization.
*)}type nonrec enable_mfa_device_request = {authentication_code2 : authentication_code_type;A subsequent authentication code emitted by the device.
The format for this parameter is a string of six digits.
Submit your request immediately after generating the authentication codes. If you generate the codes and then wait too long to submit the request, the MFA device successfully associates with the user but the MFA device becomes out of sync. This happens because time-based one-time passwords (TOTP) expire after a short period of time. If this happens, you can resync the device.
*)authentication_code1 : authentication_code_type;An authentication code emitted by the device.
The format for this parameter is a string of six digits.
Submit your request immediately after generating the authentication codes. If you generate the codes and then wait too long to submit the request, the MFA device successfully associates with the user but the MFA device becomes out of sync. This happens because time-based one-time passwords (TOTP) expire after a short period of time. If this happens, you can resync the device.
*)serial_number : serial_number_type;The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@:/-
*)user_name : existing_user_name_type;The name of the IAM user for whom you want to enable the MFA device.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec disable_organizations_root_sessions_response = {enabled_features : features_list_type option;The features you have enabled for centralized root access of member accounts in your organization.
*)organization_id : organization_id_type option;The unique identifier (ID) of an organization.
*)}type nonrec disable_organizations_root_credentials_management_response = {enabled_features : features_list_type option;The features enabled for centralized root access for member accounts in your organization.
*)organization_id : organization_id_type option;The unique identifier (ID) of an organization.
*)}type nonrec detach_user_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to detach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)user_name : user_name_type;The name (friendly name, not ARN) of the IAM user to detach the policy from.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec detach_role_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to detach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)role_name : role_name_type;The name (friendly name, not ARN) of the IAM role to detach the policy from.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec detach_group_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to detach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)group_name : group_name_type;The name (friendly name, not ARN) of the IAM group to detach the policy from.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_virtual_mfa_device_request = {serial_number : serial_number_type;The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the same as the ARN.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@:/-
*)}The request was rejected because it attempted to delete a resource that has attached subordinate entities. The error message describes these entities.
type nonrec delete_user_request = {user_name : existing_user_name_type;The name of the user to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_user_policy_request = {policy_name : policy_name_type;The name identifying the policy document to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)user_name : existing_user_name_type;The name (friendly name, not ARN) identifying the user that the policy is embedded in.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_user_permissions_boundary_request = {user_name : user_name_type;The name (friendly name, not ARN) of the IAM user from which you want to remove the permissions boundary.
*)}type nonrec delete_signing_certificate_request = {certificate_id : certificate_id_type;The ID of the signing certificate to delete.
The format of this parameter, as described by its regex pattern, is a string of characters that can be upper- or lower-cased letters or digits.
*)user_name : existing_user_name_type option;The name of the user the signing certificate belongs to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_service_specific_credential_request = {service_specific_credential_id : service_specific_credential_id;The unique identifier of the service-specific credential. You can get this value by calling ListServiceSpecificCredentials.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type option;The name of the IAM user associated with the service-specific credential. If this value is not specified, then the operation assumes the user whose credentials are used to call the operation.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_service_linked_role_response = {deletion_task_id : deletion_task_id_type;The deletion task identifier that you can use to check the status of the deletion. This identifier is returned in the format
task/aws-service-role///.
*)}type nonrec delete_service_linked_role_request = {role_name : role_name_type;The name of the service-linked role to be deleted.
*)}type nonrec delete_server_certificate_request = {server_certificate_name : server_certificate_name_type;The name of the server certificate you want to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_ssh_public_key_request = {ssh_public_key_id : public_key_id_type;The unique identifier for the SSH public key.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : user_name_type;The name of the IAM user associated with the SSH public key.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_saml_provider_request = {saml_provider_arn : arn_type;The Amazon Resource Name (ARN) of the SAML provider to delete.
*)}type nonrec delete_role_request = {role_name : role_name_type;The name of the role to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_role_policy_request = {policy_name : policy_name_type;The name of the inline policy to delete from the specified IAM role.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)role_name : role_name_type;The name (friendly name, not ARN) identifying the role that the policy is embedded in.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_role_permissions_boundary_request = {role_name : role_name_type;The name (friendly name, not ARN) of the IAM role from which you want to remove the permissions boundary.
*)}type nonrec delete_policy_version_request = {version_id : policy_version_id_type;The policy version to delete.
This parameter allows (through its regex pattern) a string of characters that consists of the lowercase letter 'v' followed by one or two digits, and optionally followed by a period '.' and a string of letters and digits.
For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
*)policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy from which you want to delete a version.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec delete_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to delete.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec delete_open_id_connect_provider_request = {open_id_connect_provider_arn : arn_type;The Amazon Resource Name (ARN) of the IAM OpenID Connect provider resource object to delete. You can get a list of OpenID Connect provider resource ARNs by using the ListOpenIDConnectProviders operation.
*)}type nonrec delete_login_profile_request = {user_name : user_name_type option;The name of the user whose password you want to delete.
This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_instance_profile_request = {instance_profile_name : instance_profile_name_type;The name of the instance profile to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_group_request = {group_name : group_name_type;The name of the IAM group to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_group_policy_request = {policy_name : policy_name_type;The name identifying the policy document to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)group_name : group_name_type;The name (friendly name, not ARN) identifying the group that the policy is embedded in.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec delete_account_alias_request = {account_alias : account_alias_type;The name of the account alias to delete.
This parameter allows (through its regex pattern) a string of characters consisting of lowercase letters, digits, and dashes. You cannot start or finish with a dash, nor can you have two dashes in a row.
*)}type nonrec delete_access_key_request = {access_key_id : access_key_id_type;The access key ID for the access key ID and secret access key you want to delete.
This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
*)user_name : existing_user_name_type option;The name of the user whose access key pair you want to delete.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec deactivate_mfa_device_request = {serial_number : serial_number_type;The serial number that uniquely identifies the MFA device. For virtual MFA devices, the serial number is the device ARN.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@:/-
*)user_name : existing_user_name_type option;The name of the user whose MFA device you want to deactivate.
This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec create_virtual_mfa_device_response = {virtual_mfa_device : virtual_mfa_device;A structure containing details about the new virtual MFA device.
*)}Contains the response to a successful CreateVirtualMFADevice request.
type nonrec create_virtual_mfa_device_request = {virtual_mfa_device_name : virtual_mfa_device_name;The name of the virtual MFA device, which must be unique. Use with path to uniquely identify a virtual MFA device.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)path : path_type option;The path for the virtual MFA device. For more information about paths, see IAM identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec create_user_response = {user : user option;A structure with details about the new IAM user.
*)}Contains the response to a successful CreateUser request.
type nonrec create_user_request = {permissions_boundary : arn_type option;The ARN of the managed policy that is used to set the permissions boundary for the user.
A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.
For more information about policy types, see Policy types in the IAM User Guide.
*)user_name : user_name_type;The name of the user to create.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
*)path : path_type option;The path for the user name. For more information about paths, see IAM identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec create_service_specific_credential_response = {service_specific_credential : service_specific_credential option;A structure that contains information about the newly created service-specific credential.
This is the only time that the password for this credential set is available. It cannot be recovered later. Instead, you must reset the password with ResetServiceSpecificCredential.
*)}type nonrec create_service_specific_credential_request = {credential_age_days : credential_age_days option;The number of days until the service specific credential expires. This field is only valid for services that support long-term API keys and must be a positive integer. When not specified, the credential will not expire.
To see which services support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.
*)service_name : service_name;The name of the Amazon Web Services service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.
*)user_name : user_name_type;The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec create_service_linked_role_request = {custom_suffix : custom_suffix_type option;A string that you provide, which is combined with the service-provided prefix to form the complete role name. If you make multiple requests for the same service, then you must supply a different CustomSuffix for each request. Otherwise the request fails with a duplicate role name error. For example, you could add -1 or -debug to the suffix.
Some services do not support the CustomSuffix parameter. If you provide an optional suffix and the operation fails, try the operation again without the suffix.
description : role_description_type option;The description of the role.
*)aws_service_name : group_name_type;The service principal for the Amazon Web Services service to which this role is attached. You use a string similar to a URL but without the http:// in front. For example: elasticbeanstalk.amazonaws.com.
Service principals are unique and case-sensitive. To find the exact service principal for your service-linked role, see Amazon Web Services services that work with IAM in the IAM User Guide. Look for the services that have Yesin the Service-Linked Role column. Choose the Yes link to view the service-linked role documentation for that service.
*)}type nonrec create_saml_provider_response = {saml_provider_arn : arn_type option;The Amazon Resource Name (ARN) of the new SAML provider resource in IAM.
*)}Contains the response to a successful CreateSAMLProvider request.
type nonrec create_saml_provider_request = {add_private_key : private_key_type option;The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
*)assertion_encryption_mode : assertion_encryption_mode_type option;Specifies the encryption setting for the SAML provider.
*)name : saml_provider_name_type;The name of the provider to create.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)saml_metadata_document : saml_metadata_document_type;An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP.
For more information, see About SAML 2.0-based federation in the IAM User Guide
*)}type nonrec create_role_response = {role : role;A structure containing details about the new role.
*)}Contains the response to a successful CreateRole request.
type nonrec create_role_request = {permissions_boundary : arn_type option;The ARN of the managed policy that is used to set the permissions boundary for the role.
A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide.
For more information about policy types, see Policy types in the IAM User Guide.
*)max_session_duration : role_max_session_duration_type option;The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours.
Anyone who assumes the role from the CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM roles in the IAM User Guide.
description : role_description_type option;A description of the role.
*)assume_role_policy_document : policy_document_type;The trust relationship policy document that grants an entity permission to assume the role.
In IAM, you must provide a JSON policy that has been converted to a string. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)Upon success, the response includes the same trust policy in JSON format.
*)role_name : role_name_type;The name of the role to create.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)path : path_type option;The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec create_policy_version_response = {policy_version : policy_version option;A structure containing details about the new policy version.
*)}Contains the response to a successful CreatePolicyVersion request.
type nonrec create_policy_version_request = {set_as_default : boolean_type option;Specifies whether to set this version as the policy's default version.
When this parameter is true, the new policy version becomes the operative version. That is, it becomes the version that is in effect for the IAM users, groups, and roles that the policy is attached to.
For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
*)policy_document : policy_document_type;The JSON policy document that you want to use as the content for this new version of the policy.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy to which you want to add a new version.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)}type nonrec create_policy_response = {policy : policy option;A structure containing details about the new policy.
*)}Contains the response to a successful CreatePolicy request.
type nonrec create_policy_request = {description : policy_description_type option;A friendly description of the policy.
Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables."
The policy description is immutable. After a value is assigned, it cannot be changed.
*)policy_document : policy_document_type;The JSON policy document that you want to use as the content for the new policy.
You must provide policies in JSON format in IAM. However, for CloudFormation templates formatted in YAML, you can provide the policy in JSON or YAML format. CloudFormation always converts a YAML policy to JSON format before submitting it to IAM.
The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and STS character quotas.
To learn more about JSON policy grammar, see Grammar of the IAM JSON policy language in the IAM User Guide.
The regex pattern used to validate this parameter is a string of characters consisting of the following:
\u0020) through the end of the ASCII character range\u00FF)\u0009), line feed (\u000A), and carriage return (\u000D)path : policy_path_type option;The path for the policy.
For more information about paths, see IAM identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
You cannot use an asterisk (*) in the path name.
*)policy_name : policy_name_type;The friendly name of the policy.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
*)}type nonrec create_open_id_connect_provider_response = {open_id_connect_provider_arn : arn_type option;The Amazon Resource Name (ARN) of the new IAM OpenID Connect provider that is created. For more information, see OpenIDConnectProviderListEntry.
*)}Contains the response to a successful CreateOpenIDConnectProvider request.
type nonrec create_open_id_connect_provider_request = {thumbprint_list : thumbprint_list_type option;A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. Typically this list includes only one entry. However, IAM lets you have up to five thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certificates.
This parameter is optional. If it is not included, IAM will retrieve and use the top intermediate certificate authority (CA) thumbprint of the OpenID Connect identity provider server certificate.
The server certificate thumbprint is the hex-encoded SHA-1 hash value of the X.509 certificate used by the domain where the OpenID Connect provider makes its keys available. It is always a 40-character string.
For example, assume that the OIDC provider is server.example.com and the provider stores its keys at https://keys.server.example.com/openid-connect. In that case, the thumbprint string would be the hex-encoded SHA-1 hash value of the certificate used by https://keys.server.example.com.
For more information about obtaining the OIDC provider thumbprint, see Obtaining the thumbprint for an OpenID Connect provider in the IAM user Guide.
If your OIDC provider's discovery endpoint and JWKS endpoint (jwks_uri) use different certificates or hosts, include the thumbprints for both endpoints in this list.
client_id_list : client_id_list_type option;Provides a list of client IDs, also known as audiences. When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. This is the value that's sent as the client_id parameter on OAuth requests.
You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider.
There is no defined format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 characters long.
url : open_id_connect_provider_url_type;The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com. The URL should not contain a port number.
You cannot register the same provider multiple times in a single Amazon Web Services account. If you try to submit a URL that has already been used for an OpenID Connect provider in the Amazon Web Services account, you will get an error.
*)}type nonrec create_login_profile_response = {login_profile : login_profile;A structure containing the user name and password create date.
*)}Contains the response to a successful CreateLoginProfile request.
type nonrec create_login_profile_request = {password_reset_required : boolean_type option;Specifies whether the user is required to set a new password on next sign-in.
*)password : password_type option;The new password for the user.
This parameter must be omitted when you make the request with an AssumeRoot session. It is required in all other cases.
The regex pattern that is used to validate this parameter is a string of characters. That string can include almost any printable ASCII character from the space (\u0020) through the end of the ASCII character range (\u00FF). You can also include the tab (\u0009), line feed (\u000A), and carriage return (\u000D) characters. Any of these characters are valid in a password. However, many tools, such as the Amazon Web Services Management Console, might restrict the ability to type certain characters because they have special meaning within that tool.
user_name : user_name_type option;The name of the IAM user to create a password for. The user must already exist.
This parameter is optional. If no user name is included, it defaults to the principal making the request. When you make this request with root user credentials, you must use an AssumeRoot session to omit the user name.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec create_instance_profile_response = {instance_profile : instance_profile;A structure containing details about the new instance profile.
*)}Contains the response to a successful CreateInstanceProfile request.
type nonrec create_instance_profile_request = {path : path_type option;The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
instance_profile_name : instance_profile_name_type;The name of the instance profile to create.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec create_group_response = {group : group;A structure containing details about the new group.
*)}Contains the response to a successful CreateGroup request.
type nonrec create_group_request = {group_name : group_name_type;The name of the group to create. Do not include the path in this value.
IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and "myresource".
*)path : path_type option;The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.
This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
}type nonrec create_delegation_request_response = {delegation_request_id : delegation_request_id_type option;The unique identifier for the created delegation request.
*)console_deep_link : console_deep_link_type option;A deep link URL to the Amazon Web Services Management Console for managing the delegation request.
For a console based workflow, partners should redirect the customer to this URL. If the customer is not logged in to any Amazon Web Services account, the Amazon Web Services workflow will automatically direct the customer to log in and then display the delegation request approval page.
*)}type nonrec create_delegation_request_request = {only_send_by_owner : boolean_type option;Specifies whether the delegation token should only be sent by the owner.
This flag prevents any party other than the owner from calling SendDelegationToken API for this delegation request. This behavior becomes useful when the delegation request owner needs to be present for subsequent partner interactions, but the delegation request was sent to a more privileged user for approval due to the owner lacking sufficient delegation permissions.
session_duration : session_duration_type;The duration for which the delegated session should remain active, in seconds.
The active time window for the session starts when the customer calls the SendDelegationToken API.
*)notification_channel : notification_channel_type;The notification channel for updates about the delegation request.
At this time,only SNS topic ARNs are accepted for notification. This topic ARN must have a resource policy granting SNS:Publish permission to the IAM service principal (iam.amazonaws.com). See partner onboarding documentation for more details.
redirect_url : redirect_url_type option;The URL to redirect to after the delegation request is processed.
This URL is used by the IAM console to show a link to the customer to re-load the partner workflow.
*)requestor_workflow_id : requestor_workflow_id_type;The workflow ID associated with the requestor.
This is the unique identifier on the partner side that can be used to track the progress of the request.
IAM maintains a uniqueness check on this workflow id for each request - if a workflow id for an existing request is passed, this API call will fail.
*)request_message : request_message_type option;A message explaining the reason for the delegation request.
Requesters can utilize this field to add a custom note to the delegation request. This field is different from the description such that this is to be utilized for a custom messaging on a case-by-case basis.
For example, if the current delegation request is in response to a previous request being rejected, this explanation can be added to the request via this field.
*)permissions : delegation_permission;The permissions to be delegated in this delegation request.
*)description : delegation_request_description_type;A description of the delegation request.
*)owner_account_id : account_id_type option;The Amazon Web Services account ID this delegation request is targeted to.
If the account ID is not known, this parameter can be omitted, resulting in a request that can be associated by any account. If the account ID passed, then the created delegation request can only be associated with an identity of that target account.
*)}type nonrec create_account_alias_request = {account_alias : account_alias_type;The account alias to create.
This parameter allows (through its regex pattern) a string of characters consisting of lowercase letters, digits, and dashes. You cannot start or finish with a dash, nor can you have two dashes in a row.
*)}type nonrec access_key = {create_date : date_type option;The date when the access key was created.
*)secret_access_key : access_key_secret_type;The secret key used to sign requests.
*)status : status_type;The status of the access key. Active means that the key is valid for API calls, while Inactive means it is not.
access_key_id : access_key_id_type;The ID for this access key.
*)user_name : user_name_type;The name of the IAM user that the access key is associated with.
*)}Contains information about an Amazon Web Services access key.
This data type is used as a response element in the CreateAccessKey and ListAccessKeys operations.
The SecretAccessKey value is returned only in response to CreateAccessKey. You can get a secret access key only when you first create an access key; you cannot recover the secret access key later. If you lose a secret access key, you must create a new access key.
type nonrec create_access_key_response = {access_key : access_key;A structure with details about the access key.
*)}Contains the response to a successful CreateAccessKey request.
type nonrec create_access_key_request = {user_name : existing_user_name_type option;The name of the IAM user that the new key will belong to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec change_password_request = {new_password : password_type;The new password. The new password must conform to the Amazon Web Services account's password policy, if one exists.
The regex pattern that is used to validate this parameter is a string of characters. That string can include almost any printable ASCII character from the space (\u0020) through the end of the ASCII character range (\u00FF). You can also include the tab (\u0009), line feed (\u000A), and carriage return (\u000D) characters. Any of these characters are valid in a password. However, many tools, such as the Amazon Web Services Management Console, might restrict the ability to type certain characters because they have special meaning within that tool.
old_password : password_type;The IAM user's current password.
*)}type nonrec attach_user_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to attach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)user_name : user_name_type;The name (friendly name, not ARN) of the IAM user to attach the policy to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec attach_role_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to attach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)role_name : role_name_type;The name (friendly name, not ARN) of the role to attach the policy to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec attach_group_policy_request = {policy_arn : arn_type;The Amazon Resource Name (ARN) of the IAM policy you want to attach.
For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.
*)group_name : group_name_type;The name (friendly name, not ARN) of the group to attach the policy to.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec associate_delegation_request_request = {delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request to associate.
*)}type nonrec add_user_to_group_request = {user_name : existing_user_name_type;The name of the user to add.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)group_name : group_name_type;The name of the group to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec add_role_to_instance_profile_request = {role_name : role_name_type;The name of the role to add.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)instance_profile_name : instance_profile_name_type;The name of the instance profile to update.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
*)}type nonrec add_client_id_to_open_id_connect_provider_request = {client_i_d : client_id_type;The client ID (also known as audience) to add to the IAM OpenID Connect provider resource.
*)open_id_connect_provider_arn : arn_type;The Amazon Resource Name (ARN) of the IAM OpenID Connect (OIDC) provider resource to add the client ID to. You can get a list of OIDC provider ARNs by using the ListOpenIDConnectProviders operation.
*)}type nonrec accept_delegation_request_request = {delegation_request_id : delegation_request_id_type;The unique identifier of the delegation request to accept.
*)}