APIs.io Engineering Platform

AWS Identity and Access Management

IAM carries the roles and policies every platform service assumes. 158 paths, 316 operations.

GitHub OpenAPI

Operations 316

Showing the first 250 of 316. The full set is in the contract, and via get_provider_operations.

GET /#Action=AddClientIDToOpenIDConnectProvider #
POST /#Action=AddClientIDToOpenIDConnectProvider #
GET /#Action=AddRoleToInstanceProfile #
POST /#Action=AddRoleToInstanceProfile #
GET /#Action=AddUserToGroup #
POST /#Action=AddUserToGroup #
GET /#Action=AttachGroupPolicy #
POST /#Action=AttachGroupPolicy #
GET /#Action=AttachRolePolicy #
POST /#Action=AttachRolePolicy #
GET /#Action=AttachUserPolicy #
POST /#Action=AttachUserPolicy #
GET /#Action=ChangePassword #
POST /#Action=ChangePassword #
GET /#Action=CreateAccessKey #
POST /#Action=CreateAccessKey #
GET /#Action=CreateAccountAlias #
POST /#Action=CreateAccountAlias #
GET /#Action=CreateGroup #
POST /#Action=CreateGroup #
GET /#Action=CreateInstanceProfile #
POST /#Action=CreateInstanceProfile #
GET /#Action=CreateLoginProfile #
POST /#Action=CreateLoginProfile #
GET /#Action=CreateOpenIDConnectProvider #
POST /#Action=CreateOpenIDConnectProvider #
GET /#Action=CreatePolicy #
POST /#Action=CreatePolicy #
GET /#Action=CreatePolicyVersion #
POST /#Action=CreatePolicyVersion #
GET /#Action=CreateRole #
POST /#Action=CreateRole #
GET /#Action=CreateSAMLProvider #
POST /#Action=CreateSAMLProvider #
GET /#Action=CreateServiceLinkedRole #
POST /#Action=CreateServiceLinkedRole #
GET /#Action=CreateServiceSpecificCredential #
POST /#Action=CreateServiceSpecificCredential #
GET /#Action=CreateUser #
POST /#Action=CreateUser #
GET /#Action=CreateVirtualMFADevice #
POST /#Action=CreateVirtualMFADevice #
GET /#Action=DeactivateMFADevice #
POST /#Action=DeactivateMFADevice #
GET /#Action=DeleteAccessKey #
POST /#Action=DeleteAccessKey #
GET /#Action=DeleteAccountAlias #
POST /#Action=DeleteAccountAlias #
GET /#Action=DeleteAccountPasswordPolicy #
POST /#Action=DeleteAccountPasswordPolicy #
GET /#Action=DeleteGroup #
POST /#Action=DeleteGroup #
GET /#Action=DeleteGroupPolicy #
POST /#Action=DeleteGroupPolicy #
GET /#Action=DeleteInstanceProfile #
POST /#Action=DeleteInstanceProfile #
GET /#Action=DeleteLoginProfile #
POST /#Action=DeleteLoginProfile #
GET /#Action=DeleteOpenIDConnectProvider #
POST /#Action=DeleteOpenIDConnectProvider #
GET /#Action=DeletePolicy #
POST /#Action=DeletePolicy #
GET /#Action=DeletePolicyVersion #
POST /#Action=DeletePolicyVersion #
GET /#Action=DeleteRole #
POST /#Action=DeleteRole #
GET /#Action=DeleteRolePermissionsBoundary #
POST /#Action=DeleteRolePermissionsBoundary #
GET /#Action=DeleteRolePolicy #
POST /#Action=DeleteRolePolicy #
GET /#Action=DeleteSAMLProvider #
POST /#Action=DeleteSAMLProvider #
GET /#Action=DeleteSSHPublicKey #
POST /#Action=DeleteSSHPublicKey #
GET /#Action=DeleteServerCertificate #
POST /#Action=DeleteServerCertificate #
GET /#Action=DeleteServiceLinkedRole #
POST /#Action=DeleteServiceLinkedRole #
GET /#Action=DeleteServiceSpecificCredential #
POST /#Action=DeleteServiceSpecificCredential #
GET /#Action=DeleteSigningCertificate #
POST /#Action=DeleteSigningCertificate #
GET /#Action=DeleteUser #
POST /#Action=DeleteUser #
GET /#Action=DeleteUserPermissionsBoundary #
POST /#Action=DeleteUserPermissionsBoundary #
GET /#Action=DeleteUserPolicy #
POST /#Action=DeleteUserPolicy #
GET /#Action=DeleteVirtualMFADevice #
POST /#Action=DeleteVirtualMFADevice #
GET /#Action=DetachGroupPolicy #
POST /#Action=DetachGroupPolicy #
GET /#Action=DetachRolePolicy #
POST /#Action=DetachRolePolicy #
GET /#Action=DetachUserPolicy #
POST /#Action=DetachUserPolicy #
GET /#Action=EnableMFADevice #
POST /#Action=EnableMFADevice #
GET /#Action=GenerateCredentialReport #
POST /#Action=GenerateCredentialReport #
GET /#Action=GenerateOrganizationsAccessReport #
POST /#Action=GenerateOrganizationsAccessReport #
GET /#Action=GenerateServiceLastAccessedDetails #
POST /#Action=GenerateServiceLastAccessedDetails #
GET /#Action=GetAccessKeyLastUsed #
POST /#Action=GetAccessKeyLastUsed #
GET /#Action=GetAccountAuthorizationDetails #
POST /#Action=GetAccountAuthorizationDetails #
GET /#Action=GetAccountPasswordPolicy #
POST /#Action=GetAccountPasswordPolicy #
GET /#Action=GetAccountSummary #
POST /#Action=GetAccountSummary #
GET /#Action=GetContextKeysForCustomPolicy #
POST /#Action=GetContextKeysForCustomPolicy #
GET /#Action=GetContextKeysForPrincipalPolicy #
POST /#Action=GetContextKeysForPrincipalPolicy #
GET /#Action=GetCredentialReport #
POST /#Action=GetCredentialReport #
GET /#Action=GetGroup #
POST /#Action=GetGroup #
GET /#Action=GetGroupPolicy #
POST /#Action=GetGroupPolicy #
GET /#Action=GetInstanceProfile #
POST /#Action=GetInstanceProfile #
GET /#Action=GetLoginProfile #
POST /#Action=GetLoginProfile #
GET /#Action=GetOpenIDConnectProvider #
POST /#Action=GetOpenIDConnectProvider #
GET /#Action=GetOrganizationsAccessReport #
POST /#Action=GetOrganizationsAccessReport #
GET /#Action=GetPolicy #
POST /#Action=GetPolicy #
GET /#Action=GetPolicyVersion #
POST /#Action=GetPolicyVersion #
GET /#Action=GetRole #
POST /#Action=GetRole #
GET /#Action=GetRolePolicy #
POST /#Action=GetRolePolicy #
GET /#Action=GetSAMLProvider #
POST /#Action=GetSAMLProvider #
GET /#Action=GetSSHPublicKey #
POST /#Action=GetSSHPublicKey #
GET /#Action=GetServerCertificate #
POST /#Action=GetServerCertificate #
GET /#Action=GetServiceLastAccessedDetails #
POST /#Action=GetServiceLastAccessedDetails #
GET /#Action=GetServiceLastAccessedDetailsWithEntities #
POST /#Action=GetServiceLastAccessedDetailsWithEntities #
GET /#Action=GetServiceLinkedRoleDeletionStatus #
POST /#Action=GetServiceLinkedRoleDeletionStatus #
GET /#Action=GetUser #
POST /#Action=GetUser #
GET /#Action=GetUserPolicy #
POST /#Action=GetUserPolicy #
GET /#Action=ListAccessKeys #
POST /#Action=ListAccessKeys #
GET /#Action=ListAccountAliases #
POST /#Action=ListAccountAliases #
GET /#Action=ListAttachedGroupPolicies #
POST /#Action=ListAttachedGroupPolicies #
GET /#Action=ListAttachedRolePolicies #
POST /#Action=ListAttachedRolePolicies #
GET /#Action=ListAttachedUserPolicies #
POST /#Action=ListAttachedUserPolicies #
GET /#Action=ListEntitiesForPolicy #
POST /#Action=ListEntitiesForPolicy #
GET /#Action=ListGroupPolicies #
POST /#Action=ListGroupPolicies #
GET /#Action=ListGroups #
POST /#Action=ListGroups #
GET /#Action=ListGroupsForUser #
POST /#Action=ListGroupsForUser #
GET /#Action=ListInstanceProfileTags #
POST /#Action=ListInstanceProfileTags #
GET /#Action=ListInstanceProfiles #
POST /#Action=ListInstanceProfiles #
GET /#Action=ListInstanceProfilesForRole #
POST /#Action=ListInstanceProfilesForRole #
GET /#Action=ListMFADeviceTags #
POST /#Action=ListMFADeviceTags #
GET /#Action=ListMFADevices #
POST /#Action=ListMFADevices #
GET /#Action=ListOpenIDConnectProviderTags #
POST /#Action=ListOpenIDConnectProviderTags #
GET /#Action=ListOpenIDConnectProviders #
POST /#Action=ListOpenIDConnectProviders #
GET /#Action=ListPolicies #
POST /#Action=ListPolicies #
GET /#Action=ListPoliciesGrantingServiceAccess #
POST /#Action=ListPoliciesGrantingServiceAccess #
GET /#Action=ListPolicyTags #
POST /#Action=ListPolicyTags #
GET /#Action=ListPolicyVersions #
POST /#Action=ListPolicyVersions #
GET /#Action=ListRolePolicies #
POST /#Action=ListRolePolicies #
GET /#Action=ListRoleTags #
POST /#Action=ListRoleTags #
GET /#Action=ListRoles #
POST /#Action=ListRoles #
GET /#Action=ListSAMLProviderTags #
POST /#Action=ListSAMLProviderTags #
GET /#Action=ListSAMLProviders #
POST /#Action=ListSAMLProviders #
GET /#Action=ListSSHPublicKeys #
POST /#Action=ListSSHPublicKeys #
GET /#Action=ListServerCertificateTags #
POST /#Action=ListServerCertificateTags #
GET /#Action=ListServerCertificates #
POST /#Action=ListServerCertificates #
GET /#Action=ListServiceSpecificCredentials #
POST /#Action=ListServiceSpecificCredentials #
GET /#Action=ListSigningCertificates #
POST /#Action=ListSigningCertificates #
GET /#Action=ListUserPolicies #
POST /#Action=ListUserPolicies #
GET /#Action=ListUserTags #
POST /#Action=ListUserTags #
GET /#Action=ListUsers #
POST /#Action=ListUsers #
GET /#Action=ListVirtualMFADevices #
POST /#Action=ListVirtualMFADevices #
GET /#Action=PutGroupPolicy #
POST /#Action=PutGroupPolicy #
GET /#Action=PutRolePermissionsBoundary #
POST /#Action=PutRolePermissionsBoundary #
GET /#Action=PutRolePolicy #
POST /#Action=PutRolePolicy #
GET /#Action=PutUserPermissionsBoundary #
POST /#Action=PutUserPermissionsBoundary #
GET /#Action=PutUserPolicy #
POST /#Action=PutUserPolicy #
GET /#Action=RemoveClientIDFromOpenIDConnectProvider #
POST /#Action=RemoveClientIDFromOpenIDConnectProvider #
GET /#Action=RemoveRoleFromInstanceProfile #
POST /#Action=RemoveRoleFromInstanceProfile #
GET /#Action=RemoveUserFromGroup #
POST /#Action=RemoveUserFromGroup #
GET /#Action=ResetServiceSpecificCredential #
POST /#Action=ResetServiceSpecificCredential #
GET /#Action=ResyncMFADevice #
POST /#Action=ResyncMFADevice #
GET /#Action=SetDefaultPolicyVersion #
POST /#Action=SetDefaultPolicyVersion #
GET /#Action=SetSecurityTokenServicePreferences #
POST /#Action=SetSecurityTokenServicePreferences #
GET /#Action=SimulateCustomPolicy #
POST /#Action=SimulateCustomPolicy #
GET /#Action=SimulatePrincipalPolicy #
POST /#Action=SimulatePrincipalPolicy #

Documentation

📖
Documentation
https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/engineering-platform/refs/heads/main/openapi/_original/aws-iam-openapi-original.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/aws-iam"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

aws-iam-openapi-original.yml Raw ↑ 
openapi: 3.0.0
info:
  version: 2010-05-08
  x-release: v4
  title: AWS Identity and Access Management
  description: <fullname>Identity and Access Management</fullname> <p>Identity and Access Management (IAM) is a web service for securely controlling access to Amazon Web Services services. With IAM, you can centrally manage users, security credentials such as access keys, and permissions that control which Amazon Web Services resources users and applications can access. For more information about IAM, see <a href="http://aws.amazon.com/iam/">Identity and Access Management (IAM)</a> and the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/">Identity and Access Management User Guide</a>.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: "#FFFFFF"
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: iam
  x-origin:
    - contentType: application/json
      url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/iam-2010-05-08.normal.json
      converter:
        url: https://github.com/mermade/aws2openapi
        version: 1.0.0
      x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
    - cloud
  x-preferred: true
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/iam/
servers:
  - url: https://iam.amazonaws.com
    variables: {}
    description: The general IAM multi-region endpoint
  - url: http://iam.us-gov.amazonaws.com
    variables: {}
    description: The general IAM endpoint for AWS GovCloud (US) and AWS GovCloud (US-East)
  - url: https://iam.us-gov.amazonaws.com
    variables: {}
    description: The general IAM endpoint for AWS GovCloud (US) and AWS GovCloud (US-East)
  - url: http://iam.cn-north-1.amazonaws.com.cn
    variables: {}
    description: The general IAM endpoint for China (Beijing) and China (Ningxia)
  - url: https://iam.cn-north-1.amazonaws.com.cn
    variables: {}
    description: The general IAM endpoint for China (Beijing) and China (Ningxia)
x-hasEquivalentPaths: true
paths:
  /#Action=AddClientIDToOpenIDConnectProvider:
    get:
      x-aws-operation-name: AddClientIDToOpenIDConnectProvider
      operationId: GET_AddClientIDToOpenIDConnectProvider
      description: <p>Adds a new client ID (also known as audience) to the list of client IDs already registered for the specified IAM OpenID Connect (OIDC) provider resource.</p> <p>This operation is idempotent; it does not fail or return an error if you add an existing client ID to the provider.</p>
      responses:
        "200":
          description: Success
        "480":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "481":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "482":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "483":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      parameters:
        - name: OpenIDConnectProviderArn
          in: query
          required: true
          description: The Amazon Resource Name (ARN) of the IAM OpenID Connect (OIDC) provider resource to add the client ID to. You can get a list of OIDC provider ARNs by using the <a>ListOpenIDConnectProviders</a> operation.
          schema:
            type: string
            description: <p>The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.</p> <p>For more information about ARNs, go to <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. </p>
            minLength: 20
            maxLength: 2048
        - name: ClientID
          in: query
          required: true
          description: The client ID (also known as audience) to add to the IAM OpenID Connect provider resource.
          schema:
            type: string
            minLength: 1
            maxLength: 255
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddClientIDToOpenIDConnectProvider
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddClientIDToOpenIDConnectProvider'
    parameters:
      - $ref: "#/components/parameters/X-Amz-Content-Sha256"
      - $ref: "#/components/parameters/X-Amz-Date"
      - $ref: "#/components/parameters/X-Amz-Algorithm"
      - $ref: "#/components/parameters/X-Amz-Credential"
      - $ref: "#/components/parameters/X-Amz-Security-Token"
      - $ref: "#/components/parameters/X-Amz-Signature"
      - $ref: "#/components/parameters/X-Amz-SignedHeaders"
    post:
      x-aws-operation-name: AddClientIDToOpenIDConnectProvider
      operationId: POST_AddClientIDToOpenIDConnectProvider
      description: <p>Adds a new client ID (also known as audience) to the list of client IDs already registered for the specified IAM OpenID Connect (OIDC) provider resource.</p> <p>This operation is idempotent; it does not fail or return an error if you add an existing client ID to the provider.</p>
      responses:
        "200":
          description: Success
        "480":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "481":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "482":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "483":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      requestBody:
        content:
          text/xml:
            schema:
              $ref: "#/components/schemas/AddClientIDToOpenIDConnectProviderRequest"
      parameters:
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddClientIDToOpenIDConnectProvider
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddClientIDToOpenIDConnectProvider'
  /#Action=AddRoleToInstanceProfile:
    get:
      x-aws-operation-name: AddRoleToInstanceProfile
      operationId: GET_AddRoleToInstanceProfile
      description: <p>Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this quota cannot be increased. You can remove the existing role and then add a different role to an instance profile. You must then wait for the change to appear across all of Amazon Web Services because of <a href="https://en.wikipedia.org/wiki/Eventual_consistency">eventual consistency</a>. To force the change, you must <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIamInstanceProfile.html">disassociate the instance profile</a> and then <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html">associate the instance profile</a>, or you can stop your instance and then restart it.</p> <note> <p>The caller of this operation must be granted the <code>PassRole</code> permission on the IAM role by a permissions policy.</p> </note> <p>For more information about roles, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html">Working with roles</a>. For more information about instance profiles, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/AboutInstanceProfiles.html">About instance profiles</a>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: EntityAlreadyExistsException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/EntityAlreadyExistsException"
        "482":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "483":
          description: UnmodifiableEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/UnmodifiableEntityException"
        "484":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      parameters:
        - name: InstanceProfileName
          in: query
          required: true
          description: '<p>The name of the instance profile to update.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 128
        - name: RoleName
          in: query
          required: true
          description: '<p>The name of the role to add.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 64
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddRoleToInstanceProfile
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddRoleToInstanceProfile'
    parameters:
      - $ref: "#/components/parameters/X-Amz-Content-Sha256"
      - $ref: "#/components/parameters/X-Amz-Date"
      - $ref: "#/components/parameters/X-Amz-Algorithm"
      - $ref: "#/components/parameters/X-Amz-Credential"
      - $ref: "#/components/parameters/X-Amz-Security-Token"
      - $ref: "#/components/parameters/X-Amz-Signature"
      - $ref: "#/components/parameters/X-Amz-SignedHeaders"
    post:
      x-aws-operation-name: AddRoleToInstanceProfile
      operationId: POST_AddRoleToInstanceProfile
      description: <p>Adds the specified IAM role to the specified instance profile. An instance profile can contain only one role, and this quota cannot be increased. You can remove the existing role and then add a different role to an instance profile. You must then wait for the change to appear across all of Amazon Web Services because of <a href="https://en.wikipedia.org/wiki/Eventual_consistency">eventual consistency</a>. To force the change, you must <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIamInstanceProfile.html">disassociate the instance profile</a> and then <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html">associate the instance profile</a>, or you can stop your instance and then restart it.</p> <note> <p>The caller of this operation must be granted the <code>PassRole</code> permission on the IAM role by a permissions policy.</p> </note> <p>For more information about roles, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html">Working with roles</a>. For more information about instance profiles, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/AboutInstanceProfiles.html">About instance profiles</a>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: EntityAlreadyExistsException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/EntityAlreadyExistsException"
        "482":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "483":
          description: UnmodifiableEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/UnmodifiableEntityException"
        "484":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      requestBody:
        content:
          text/xml:
            schema:
              $ref: "#/components/schemas/AddRoleToInstanceProfileRequest"
      parameters:
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddRoleToInstanceProfile
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddRoleToInstanceProfile'
  /#Action=AddUserToGroup:
    get:
      x-aws-operation-name: AddUserToGroup
      operationId: GET_AddUserToGroup
      description: Adds the specified user to the specified group.
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      parameters:
        - name: GroupName
          in: query
          required: true
          description: '<p>The name of the group to update.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 128
        - name: UserName
          in: query
          required: true
          description: '<p>The name of the user to add.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 128
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddUserToGroup
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddUserToGroup'
    parameters:
      - $ref: "#/components/parameters/X-Amz-Content-Sha256"
      - $ref: "#/components/parameters/X-Amz-Date"
      - $ref: "#/components/parameters/X-Amz-Algorithm"
      - $ref: "#/components/parameters/X-Amz-Credential"
      - $ref: "#/components/parameters/X-Amz-Security-Token"
      - $ref: "#/components/parameters/X-Amz-Signature"
      - $ref: "#/components/parameters/X-Amz-SignedHeaders"
    post:
      x-aws-operation-name: AddUserToGroup
      operationId: POST_AddUserToGroup
      description: Adds the specified user to the specified group.
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      requestBody:
        content:
          text/xml:
            schema:
              $ref: "#/components/schemas/AddUserToGroupRequest"
      parameters:
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AddUserToGroup
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AddUserToGroup'
  /#Action=AttachGroupPolicy:
    get:
      x-aws-operation-name: AttachGroupPolicy
      operationId: GET_AttachGroupPolicy
      description: <p>Attaches the specified managed policy to the specified IAM group.</p> <p>You use this operation to attach a managed policy to a group. To embed an inline policy in a group, use <a>PutGroupPolicy</a>.</p> <p>As a best practice, you can validate your IAM policies. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html">Validating IAM policies</a> in the <i>IAM User Guide</i>.</p> <p>For more information about policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html">Managed policies and inline policies</a> in the <i>IAM User Guide</i>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "483":
          description: PolicyNotAttachableException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/PolicyNotAttachableException"
        "484":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      parameters:
        - name: GroupName
          in: query
          required: true
          description: '<p>The name (friendly name, not ARN) of the group to attach the policy to.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 128
        - name: PolicyArn
          in: query
          required: true
          description: <p>The Amazon Resource Name (ARN) of the IAM policy you want to attach.</p> <p>For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>.</p>
          schema:
            type: string
            description: <p>The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.</p> <p>For more information about ARNs, go to <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. </p>
            minLength: 20
            maxLength: 2048
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AttachGroupPolicy
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AttachGroupPolicy'
    parameters:
      - $ref: "#/components/parameters/X-Amz-Content-Sha256"
      - $ref: "#/components/parameters/X-Amz-Date"
      - $ref: "#/components/parameters/X-Amz-Algorithm"
      - $ref: "#/components/parameters/X-Amz-Credential"
      - $ref: "#/components/parameters/X-Amz-Security-Token"
      - $ref: "#/components/parameters/X-Amz-Signature"
      - $ref: "#/components/parameters/X-Amz-SignedHeaders"
    post:
      x-aws-operation-name: AttachGroupPolicy
      operationId: POST_AttachGroupPolicy
      description: <p>Attaches the specified managed policy to the specified IAM group.</p> <p>You use this operation to attach a managed policy to a group. To embed an inline policy in a group, use <a>PutGroupPolicy</a>.</p> <p>As a best practice, you can validate your IAM policies. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html">Validating IAM policies</a> in the <i>IAM User Guide</i>.</p> <p>For more information about policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html">Managed policies and inline policies</a> in the <i>IAM User Guide</i>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "483":
          description: PolicyNotAttachableException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/PolicyNotAttachableException"
        "484":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      requestBody:
        content:
          text/xml:
            schema:
              $ref: "#/components/schemas/AttachGroupPolicyRequest"
      parameters:
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AttachGroupPolicy
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AttachGroupPolicy'
  /#Action=AttachRolePolicy:
    get:
      x-aws-operation-name: AttachRolePolicy
      operationId: GET_AttachRolePolicy
      description: <p>Attaches the specified managed policy to the specified IAM role. When you attach a managed policy to a role, the managed policy becomes part of the role's permission (access) policy.</p> <note> <p>You cannot use a managed policy as the role's trust policy. The role's trust policy is created at the same time as the role, using <a>CreateRole</a>. You can update a role's trust policy using <a>UpdateAssumeRolePolicy</a>.</p> </note> <p>Use this operation to attach a <i>managed</i> policy to a role. To embed an inline policy in a role, use <a>PutRolePolicy</a>. For more information about policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html">Managed policies and inline policies</a> in the <i>IAM User Guide</i>.</p> <p>As a best practice, you can validate your IAM policies. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html">Validating IAM policies</a> in the <i>IAM User Guide</i>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "483":
          description: UnmodifiableEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/UnmodifiableEntityException"
        "484":
          description: PolicyNotAttachableException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/PolicyNotAttachableException"
        "485":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      parameters:
        - name: RoleName
          in: query
          required: true
          description: '<p>The name (friendly name, not ARN) of the role to attach the policy to.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>'
          schema:
            type: string
            pattern: "[\\w+=,.@-]+"
            minLength: 1
            maxLength: 64
        - name: PolicyArn
          in: query
          required: true
          description: <p>The Amazon Resource Name (ARN) of the IAM policy you want to attach.</p> <p>For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>.</p>
          schema:
            type: string
            description: <p>The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.</p> <p>For more information about ARNs, go to <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>. </p>
            minLength: 20
            maxLength: 2048
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AttachRolePolicy
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AttachRolePolicy'
    parameters:
      - $ref: "#/components/parameters/X-Amz-Content-Sha256"
      - $ref: "#/components/parameters/X-Amz-Date"
      - $ref: "#/components/parameters/X-Amz-Algorithm"
      - $ref: "#/components/parameters/X-Amz-Credential"
      - $ref: "#/components/parameters/X-Amz-Security-Token"
      - $ref: "#/components/parameters/X-Amz-Signature"
      - $ref: "#/components/parameters/X-Amz-SignedHeaders"
    post:
      x-aws-operation-name: AttachRolePolicy
      operationId: POST_AttachRolePolicy
      description: <p>Attaches the specified managed policy to the specified IAM role. When you attach a managed policy to a role, the managed policy becomes part of the role's permission (access) policy.</p> <note> <p>You cannot use a managed policy as the role's trust policy. The role's trust policy is created at the same time as the role, using <a>CreateRole</a>. You can update a role's trust policy using <a>UpdateAssumeRolePolicy</a>.</p> </note> <p>Use this operation to attach a <i>managed</i> policy to a role. To embed an inline policy in a role, use <a>PutRolePolicy</a>. For more information about policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html">Managed policies and inline policies</a> in the <i>IAM User Guide</i>.</p> <p>As a best practice, you can validate your IAM policies. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html">Validating IAM policies</a> in the <i>IAM User Guide</i>.</p>
      responses:
        "200":
          description: Success
        "480":
          description: NoSuchEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/NoSuchEntityException"
        "481":
          description: LimitExceededException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/LimitExceededException"
        "482":
          description: InvalidInputException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/InvalidInputException"
        "483":
          description: UnmodifiableEntityException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/UnmodifiableEntityException"
        "484":
          description: PolicyNotAttachableException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/PolicyNotAttachableException"
        "485":
          description: ServiceFailureException
          content:
            text/xml:
              schema:
                $ref: "#/components/schemas/ServiceFailureException"
      requestBody:
        content:
          text/xml:
            schema:
              $ref: "#/components/schemas/AttachRolePolicyRequest"
      parameters:
        - name: Action
          in: query
          required: true
          schema:
            type: string
            enum:
              - AttachRolePolicy
        - name: Version
          in: query
          required: true
          schema:
            type: string
            enum:
              - 2010-05-08
      tags:
        - '#Action=AttachRolePolicy'
  /#Action=AttachUserPolicy:
    get:
      x-aws-operation-name: AttachUserPolicy
      operatio

# --- truncated at 32 KB (1431 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/engineering-platform/refs/heads/main/openapi/_original/aws-iam-openapi-original.yml