boto3_iam

Connection module for Amazon IAM using boto3.

Renamed from boto_iam to boto3_iam and rewritten to use the boto3 IAM client API directly via saltext.boto3.utils.boto3mod. The legacy boto2 code path has been removed.

depends:

• boto3 >= 1.28.0

• botocore >= 1.31.0

configuration:

This module accepts explicit IAM credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More Information available at:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

If IAM roles are not used you need to specify them either in the minion’s config file or as a profile. For example, to specify them in the minion’s config file:

iam.keyid: GKTADJGHEIQSXMKKRBJ08H
iam.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

A region may also be specified in the configuration:

iam.region: us-east-1

It’s also possible to specify key, keyid and region via a profile, either as a passed in dict, or as a string to pull from pillars or minion config:

myprofile:
    keyid: GKTADJGHEIQSXMKKRBJ08H
    key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
    region: us-east-1

Added in version 1.0.0.

saltext.boto3.modules.boto3_iam.__virtual__()

Only load if boto3 is available.

saltext.boto3.modules.boto3_iam.instance_profile_exists(name, region=None, key=None, keyid=None, profile=None)

Check to see if an instance profile exists.

name (str):

The name of the instance profile to check.

region (str, optional):

The AWS region where the instance profile is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.instance_profile_exists myiprofile

saltext.boto3.modules.boto3_iam.create_instance_profile(name, region=None, key=None, keyid=None, profile=None)

Create an instance profile.

name (str):

The name of the instance profile to create.

region (str, optional):

The AWS region where the instance profile will be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_instance_profile myiprofile

saltext.boto3.modules.boto3_iam.delete_instance_profile(name, region=None, key=None, keyid=None, profile=None)

Delete an instance profile.

name (str):

The name of the instance profile to delete.

region (str, optional):

The AWS region where the instance profile is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_instance_profile myiprofile

saltext.boto3.modules.boto3_iam.get_all_instance_profiles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM instance profiles, starting at the optional path.

path_prefix (str, optional):

The path prefix for filtering the instance profiles. Defaults to “/”.

region (str, optional):

The AWS region where the instance profiles are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.get_all_instance_profiles

saltext.boto3.modules.boto3_iam.list_instance_profiles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

List all IAM instance profiles, starting at the optional path.

path_prefix (str, optional):

The path prefix for filtering the instance profiles. Defaults to “/”.

region (str, optional):

The AWS region where the instance profiles are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.list_instance_profiles

saltext.boto3.modules.boto3_iam.role_exists(name, region=None, key=None, keyid=None, profile=None)

Check to see if an IAM role exists.

name (str):

The name of the role to check.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.role_exists myirole

saltext.boto3.modules.boto3_iam.describe_role(name, region=None, key=None, keyid=None, profile=None)

Get information for a role.

name (str):

The name of the role to describe.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.describe_role myirole

saltext.boto3.modules.boto3_iam.create_role(name, policy_document=None, path=None, region=None, key=None, keyid=None, profile=None)

Create an IAM role.

name (str):

The name of the role to create.

policy_document (str or dict, optional):

The policy document that defines the trust relationship for the role.

path (str, optional):

The path for the role.

region (str, optional):

The AWS region where the role will be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_role myrole

saltext.boto3.modules.boto3_iam.delete_role(name, region=None, key=None, keyid=None, profile=None)

Delete an IAM role.

name (str):

The name of the role to delete.

region (str, optional):

The AWS region where the role will be deleted.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_role myirole

saltext.boto3.modules.boto3_iam.profile_associated(role_name, profile_name, region, key, keyid, profile)

Check to see if an instance profile is associated with an IAM role.

role_name (str):

The name of the IAM role to check.

profile_name (str):

The name of the instance profile to check.

region (str, optional):

The AWS region where the role and instance profile are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.profile_associated myirole myiprofile

saltext.boto3.modules.boto3_iam.associate_profile_to_role(profile_name, role_name, region=None, key=None, keyid=None, profile=None)

Associate an instance profile with an IAM role.

role_name (str):

The name of the IAM role to associate the instance profile with.

profile_name (str):

The name of the instance profile to associate with the IAM role.

region (str, optional):

The AWS region where the role and instance profile are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.associate_profile_to_role myirole myiprofile

saltext.boto3.modules.boto3_iam.disassociate_profile_from_role(profile_name, role_name, region=None, key=None, keyid=None, profile=None)

Disassociate an instance profile from an IAM role.

role_name (str):

The name of the IAM role to disassociate the instance profile from.

profile_name (str):

The name of the instance profile to disassociate from the IAM role.

region (str, optional):

The AWS region where the role and instance profile are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.disassociate_profile_from_role myiprofile myirole

saltext.boto3.modules.boto3_iam.list_role_policies(role_name, region=None, key=None, keyid=None, profile=None)

Get a list of inline policy names from a role.

role_name (str):

The name of the IAM role to list inline policies for.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_role_policies myirole

saltext.boto3.modules.boto3_iam.get_role_policy(role_name, policy_name, region=None, key=None, keyid=None, profile=None)

Get a role policy.

role_name (str):

The name of the IAM role the policy is attached to.

policy_name (str):

The name of the inline policy to retrieve.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_role_policy myirole mypolicy

saltext.boto3.modules.boto3_iam.create_role_policy(role_name, policy_name, policy, region=None, key=None, keyid=None, profile=None)

Create or modify a role policy.

role_name (str):

The name of the IAM role the policy is attached to.

policy_name (str):

The name of the inline policy to create or modify.

policy (dict or str):

The policy document to attach to the role. Can be a dictionary or a JSON string.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_role_policy myirole mypolicy '{...}'

saltext.boto3.modules.boto3_iam.delete_role_policy(role_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete a role policy.

role_name (str):

The name of the IAM role the policy is attached to.

policy_name (str):

The name of the inline policy to delete.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_role_policy myirole mypolicy

saltext.boto3.modules.boto3_iam.update_assume_role_policy(role_name, policy_document, region=None, key=None, keyid=None, profile=None)

Update an assume role policy for a role.

role_name (str):

The name of the IAM role to update the assume role policy for.

policy_document (dict or str):

The policy document to set as the assume role policy. Can be a dictionary or a JSON string.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.update_assume_role_policy myrole '{"Statement":"..."}'

saltext.boto3.modules.boto3_iam.build_policy(region=None, key=None, keyid=None, profile=None)

Build a default assume role policy for EC2.

region (str, optional):

The AWS region where the role is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.build_policy

saltext.boto3.modules.boto3_iam.get_all_roles(path_prefix=None, region=None, key=None, keyid=None, profile=None)

Get and return all IAM role details, starting at the optional path.

path_prefix (str, optional):

The path prefix for filtering the IAM roles.

region (str, optional):

The AWS region where the roles are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.get_all_roles

saltext.boto3.modules.boto3_iam.get_user(user_name=None, region=None, key=None, keyid=None, profile=None)

Get user information.

user_name (str, optional):

The name of the IAM user to retrieve information for. If not provided, information for the current user is returned.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_user myuser

saltext.boto3.modules.boto3_iam.create_user(user_name, path=None, region=None, key=None, keyid=None, profile=None)

Create a user.

user_name (str):

The name of the IAM user to create.

path (str, optional):

The path for the IAM user. Defaults to “/”.

region (str, optional):

The AWS region where the user will be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_user myuser

saltext.boto3.modules.boto3_iam.delete_user(user_name, region=None, key=None, keyid=None, profile=None)

Delete a user.

user_name (str):

The name of the IAM user to delete.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_user myuser

saltext.boto3.modules.boto3_iam.get_all_access_keys(user_name, marker=None, max_items=None, region=None, key=None, keyid=None, profile=None)

Get all access keys for a user.

user_name (str):

The name of the IAM user to retrieve access keys for.

marker (str, optional):

Use this only when paginating results to indicate the marker for the next set of results.

max_items (int, optional):

Use this only when paginating results to indicate the maximum number of items to return.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_all_access_keys myuser

saltext.boto3.modules.boto3_iam.create_access_key(user_name, region=None, key=None, keyid=None, profile=None)

Create access key id for a user.

user_name (str):

The name of the IAM user to create the access key for.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_access_key myuser

saltext.boto3.modules.boto3_iam.delete_access_key(access_key_id, user_name=None, region=None, key=None, keyid=None, profile=None)

Delete access key id from a user.

user_name (str, optional):

The name of the IAM user to delete the access key from. If not provided, the current user’s access key will be deleted.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_access_key myaccesskeyid myuser

saltext.boto3.modules.boto3_iam.get_all_users(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM user details, starting at the optional path.

path_prefix (str, optional):

The path prefix for filtering the IAM users. Defaults to “/”.

region (str, optional):

The AWS region where the users are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.get_all_users

saltext.boto3.modules.boto3_iam.get_all_user_policies(user_name, marker=None, max_items=None, region=None, key=None, keyid=None, profile=None)

Get all inline user policy names.

user_name (str):

The name of the IAM user whose inline policies are to be retrieved.

marker (str, optional):

Use this only when paginating results to indicate the marker for the next set of results.

max_items (int, optional):

Use this only when paginating results to indicate the maximum number of items to return.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_all_user_policies myuser

saltext.boto3.modules.boto3_iam.get_user_policy(user_name, policy_name, region=None, key=None, keyid=None, profile=None)

Retrieves the specified inline policy document for the specified user.

user_name (str):

The name of the IAM user whose inline policy is to be retrieved.

policy_name (str):

The name of the inline policy to retrieve.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_user_policy myuser mypolicyname

saltext.boto3.modules.boto3_iam.put_user_policy(user_name, policy_name, policy_json, region=None, key=None, keyid=None, profile=None)

Adds or updates the specified inline policy document for the specified user.

user_name (str):

The name of the IAM user for whom the inline policy is to be added or updated.

policy_name (str):

The name of the inline policy to add or update.

policy_json (str or dict):

The JSON policy document as a string or dictionary.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.put_user_policy myuser policyname policyrules

saltext.boto3.modules.boto3_iam.delete_user_policy(user_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete an inline user policy.

user_name (str):

The name of the IAM user whose inline policy is to be deleted.

policy_name (str):

The name of the inline policy to delete.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_user_policy myuser mypolicy

saltext.boto3.modules.boto3_iam.get_group(group_name, region=None, key=None, keyid=None, profile=None)

Get group information.

group_name (str):

The name of the IAM group whose information is to be retrieved.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_group mygroup

saltext.boto3.modules.boto3_iam.create_group(group_name, path=None, region=None, key=None, keyid=None, profile=None)

Create a group.

path (str, optional):

The path for the IAM group. Defaults to “/”.

region (str, optional):

The AWS region where the group is to be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_group group

saltext.boto3.modules.boto3_iam.get_group_members(group_name, region=None, key=None, keyid=None, profile=None)

Get the users that are members of a group.

group_name (str):

The name of the IAM group whose members are to be retrieved.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_group_members mygroup

saltext.boto3.modules.boto3_iam.user_exists_in_group(user_name, group_name, region=None, key=None, keyid=None, profile=None)

Check if user exists in group.

user_name (str):

The name of the IAM user to check for membership in the group.

group_name (str):

The name of the IAM group to check for the user’s membership.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.user_exists_in_group myuser mygroup

saltext.boto3.modules.boto3_iam.add_user_to_group(user_name, group_name, region=None, key=None, keyid=None, profile=None)

Add user to group.

user_name (str):

The name of the IAM user to add to the group.

group_name (str):

The name of the IAM group to which the user is to be added.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.add_user_to_group myuser mygroup

saltext.boto3.modules.boto3_iam.remove_user_from_group(user_name, group_name, region=None, key=None, keyid=None, profile=None)

Remove user from group.

user_name (str):

The name of the IAM user to remove from the group.

group_name (str):

The name of the IAM group from which the user is to be removed.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.remove_user_from_group myuser mygroup

saltext.boto3.modules.boto3_iam.put_group_policy(group_name, policy_name, policy_json, region=None, key=None, keyid=None, profile=None)

Adds or updates the specified inline policy document for the specified group.

group_name (str):

The name of the IAM group to which the policy is to be attached.

policy_name (str):

The name of the policy to add or update.

policy_json (str or dict):

The JSON policy document to attach to the group.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.put_group_policy mygroup policyname policyrules

saltext.boto3.modules.boto3_iam.delete_group_policy(group_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete a group policy.

group_name (str):

The name of the IAM group from which the policy is to be deleted.

policy_name (str):

The name of the policy to delete.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_group_policy mygroup mypolicy

saltext.boto3.modules.boto3_iam.get_group_policy(group_name, policy_name, region=None, key=None, keyid=None, profile=None)

Retrieves the specified inline policy document for the specified group.

group_name (str):

The name of the IAM group containing the policy.

policy_name (str):

The name of the policy to retrieve.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_group_policy mygroup policyname

saltext.boto3.modules.boto3_iam.get_all_groups(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM group details, starting at the optional path.

path_prefix (str, optional):

The path prefix for filtering the IAM groups. Defaults to “/”.

region (str, optional):

The AWS region where the groups are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.get_all_groups

saltext.boto3.modules.boto3_iam.get_all_group_policies(group_name, region=None, key=None, keyid=None, profile=None)

Get a list of inline policy names from a group.

group_name (str):

The name of the IAM group whose inline policies are to be listed.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_all_group_policies mygroup

saltext.boto3.modules.boto3_iam.delete_group(group_name, region=None, key=None, keyid=None, profile=None)

Delete a group.

group_name (str):

The name of the IAM group to delete.

region (str, optional):

The AWS region where the group is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_group mygroup

saltext.boto3.modules.boto3_iam.create_login_profile(user_name, password, region=None, key=None, keyid=None, profile=None)

Creates a login profile for the specified user.

user_name (str):

The name of the IAM user for whom to create the login profile.

password (str):

The password for the IAM user’s login profile.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_login_profile user_name password

saltext.boto3.modules.boto3_iam.delete_login_profile(user_name, region=None, key=None, keyid=None, profile=None)

Deletes a login profile for the specified user.

user_name (str):

The name of the IAM user whose login profile is to be deleted.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_login_profile user_name

saltext.boto3.modules.boto3_iam.get_all_mfa_devices(user_name, region=None, key=None, keyid=None, profile=None)

Get all MFA devices associated with an IAM user.

user_name (str):

The name of the IAM user whose MFA devices are to be retrieved.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_all_mfa_devices user_name

saltext.boto3.modules.boto3_iam.deactivate_mfa_device(user_name, serial, region=None, key=None, keyid=None, profile=None)

Deactivates the specified MFA device and removes it from association with the user.

user_name (str):

The name of the IAM user whose MFA device is to be deactivated.

serial (str):

The serial number of the MFA device to deactivate.

region (str, optional):

The AWS region where the user is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.deactivate_mfa_device user_name serial_num

saltext.boto3.modules.boto3_iam.delete_virtual_mfa_device(serial, region=None, key=None, keyid=None, profile=None)

Deletes the specified virtual MFA device.

serial (str):

The serial number of the virtual MFA device to delete.

region (str, optional):

The AWS region where the virtual MFA device is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_virtual_mfa_device serial_num

saltext.boto3.modules.boto3_iam.update_account_password_policy(allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, region=None, key=None, keyid=None, profile=None)

Update the password policy for the AWS account.

allow_users_to_change_password (bool, optional):

Whether to allow users to change their own passwords.

hard_expiry (bool, optional):

Whether to enable hard expiry for passwords.

max_password_age (int, optional):

The maximum age of passwords in days.

minimum_password_length (int, optional):

The minimum length of passwords.

password_reuse_prevention (int, optional):

The number of previous passwords to remember and prevent reuse.

require_lowercase_characters (bool, optional):

Whether to require lowercase characters in passwords.

require_numbers (bool, optional):

Whether to require numbers in passwords.

require_symbols (bool, optional):

Whether to require symbols in passwords.

require_uppercase_characters (bool, optional):

Whether to require uppercase characters in passwords.

region (str, optional):

The AWS region where the account is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.update_account_password_policy True

saltext.boto3.modules.boto3_iam.get_account_policy(region=None, key=None, keyid=None, profile=None)

Get account password policy for the AWS account.

region (str, optional):

The AWS region where the account is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_account_policy

saltext.boto3.modules.boto3_iam.get_account_id(region=None, key=None, keyid=None, profile=None)

Get the AWS account id associated with the used credentials.

region (str, optional):

The AWS region where the account is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_account_id

saltext.boto3.modules.boto3_iam.upload_server_cert(cert_name, cert_body, private_key, cert_chain=None, path=None, region=None, key=None, keyid=None, profile=None)

Upload a server certificate to AWS IAM.

cert_name (str):

The name of the server certificate.

cert_body (str):

The body of the server certificate.

private_key (str):

The private key associated with the server certificate.

cert_chain (str, optional):

The certificate chain for the server certificate.

path (str, optional):

The path within IAM to upload the server certificate.

region (str, optional):

The AWS region where the server certificate will be uploaded.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.upload_server_cert mycert_name crt priv_key

saltext.boto3.modules.boto3_iam.get_server_certificate(cert_name, region=None, key=None, keyid=None, profile=None)

Returns certificate information for a server cert.

cert_name (str):

The name of the server certificate.

region (str, optional):

The AWS region where the server certificate is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_server_certificate mycert_name

saltext.boto3.modules.boto3_iam.delete_server_cert(cert_name, region=None, key=None, keyid=None, profile=None)

Deletes a server certificate.

cert_name (str):

The name of the server certificate to delete.

region (str, optional):

The AWS region where the server certificate is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_server_cert mycert_name

saltext.boto3.modules.boto3_iam.export_users(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get all IAM user details as a yaml sls structure.

path_prefix (str, optional):

The path prefix for filtering IAM users.

region (str, optional):

The AWS region where the IAM users are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.export_users --out=txt | sed "s/local: //" > iam_users.sls

saltext.boto3.modules.boto3_iam.export_roles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get all IAM role details as a yaml sls structure.

path_prefix (str, optional):

The path prefix for filtering IAM roles.

region (str, optional):

The AWS region where the IAM roles are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt-call boto3_iam.export_roles --out=txt | sed "s/local: //" > iam_roles.sls

saltext.boto3.modules.boto3_iam.policy_exists(policy_name, region=None, key=None, keyid=None, profile=None)

Check to see if a managed policy exists.

name (str):

The name of the managed policy to check for existence.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.policy_exists mypolicy

saltext.boto3.modules.boto3_iam.get_policy(policy_name, region=None, key=None, keyid=None, profile=None)

Get the managed policy info.

name (str):

The name of the managed policy to retrieve.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_policy mypolicy

saltext.boto3.modules.boto3_iam.create_policy(policy_name, policy_document, path=None, description=None, region=None, key=None, keyid=None, profile=None)

Create a managed policy.

name (str):

The name of the managed policy to create.

policy_document (str):

The JSON policy document for the managed policy.

path (str, optional):

The path for the managed policy.

description (str, optional):

The description of the managed policy.

region (str, optional):

The AWS region where the managed policy is to be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_policy mypolicy '{"Version": "2012-10-17", ...}'

saltext.boto3.modules.boto3_iam.delete_policy(policy_name, region=None, key=None, keyid=None, profile=None)

Delete a managed policy.

name (str):

The name of the managed policy to delete.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_policy mypolicy

saltext.boto3.modules.boto3_iam.list_policies(region=None, key=None, keyid=None, profile=None)

List managed policies.

region (str, optional):

The AWS region where the managed policies are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_policies

saltext.boto3.modules.boto3_iam.policy_version_exists(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Check to see if a specific version of a managed policy exists.

name (str):

The name of the managed policy to check.

version_id (str):

The ID of the policy version to check.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.policy_version_exists mypolicy v1

saltext.boto3.modules.boto3_iam.get_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Get a specific version of a managed policy.

name (str):

The name of the managed policy to retrieve.

version_id (str):

The ID of the policy version to retrieve.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_policy_version mypolicy v1

saltext.boto3.modules.boto3_iam.create_policy_version(policy_name, policy_document, set_as_default=None, region=None, key=None, keyid=None, profile=None)

Create a version of a managed policy.

name (str):

The name of the managed policy to create a version for.

policy_document (str):

The JSON policy document for the new policy version.

set_as_default (bool, optional):

Whether to set the new policy version as the default version.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_policy_version mypolicy '{...}' True

saltext.boto3.modules.boto3_iam.delete_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Delete a version of a managed policy.

policy_name (str):

The name of the managed policy to delete a version for.

version_id (str):

The ID of the policy version to delete.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_policy_version mypolicy v1

saltext.boto3.modules.boto3_iam.list_policy_versions(policy_name, region=None, key=None, keyid=None, profile=None)

List versions of a managed policy.

policy_name (str):

The name of the managed policy to list versions for.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_policy_versions mypolicy

saltext.boto3.modules.boto3_iam.set_default_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Set the default version of a managed policy.

policy_name (str):

The name of the managed policy to set the default version for.

version_id (str):

The ID of the policy version to set as the default.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.set_default_policy_version mypolicy v1

saltext.boto3.modules.boto3_iam.attach_user_policy(policy_name, user_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a user.

policy_name (str):

The name of the managed policy to attach to the user.

user_name (str):

The name of the IAM user to attach the policy to.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.attach_user_policy mypolicy myuser

saltext.boto3.modules.boto3_iam.detach_user_policy(policy_name, user_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy from a user.

policy_name (str):

The name of the managed policy to detach from the user.

user_name (str):

The name of the IAM user to detach the policy from.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.detach_user_policy mypolicy myuser

saltext.boto3.modules.boto3_iam.attach_group_policy(policy_name, group_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a group.

policy_name (str):

The name of the managed policy to attach to the group.

group_name (str):

The name of the IAM group to attach the policy to.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.attach_group_policy mypolicy mygroup

saltext.boto3.modules.boto3_iam.detach_group_policy(policy_name, group_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy from a group.

policy_name (str):

The name of the managed policy to detach from the group.

group_name (str):

The name of the IAM group to detach the policy from.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.detach_group_policy mypolicy mygroup

saltext.boto3.modules.boto3_iam.attach_role_policy(policy_name, role_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a role.

policy_name (str):

The name of the managed policy to attach to the role.

role_name (str):

The name of the IAM role to attach the policy to.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.attach_role_policy mypolicy myrole

saltext.boto3.modules.boto3_iam.detach_role_policy(policy_name, role_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy from a role.

policy_name (str):

The name of the managed policy to detach from the role.

role_name (str):

The name of the IAM role to detach the policy from.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.detach_role_policy mypolicy myrole

saltext.boto3.modules.boto3_iam.list_entities_for_policy(policy_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List entities (users, groups, roles) that a policy is attached to.

policy_name (str):

The name of the managed policy to list entities for.

path_prefix (str, optional):

The path prefix for filtering the results.

entity_filter (str, optional):

The entity type to filter the results by. Valid values are ‘User’, ‘Group’, or ‘Role’.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_entities_for_policy mypolicy

saltext.boto3.modules.boto3_iam.list_attached_user_policies(user_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List managed policies attached to the given user.

user_name (str):

The name of the IAM user whose attached policies are to be listed.

path_prefix (str, optional):

The path prefix for filtering the results.

entity_filter (str, optional):

The entity type to filter the results by. Valid values are ‘User’, ‘Group’, or ‘Role’.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_attached_user_policies myuser

saltext.boto3.modules.boto3_iam.list_attached_group_policies(group_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List managed policies attached to the given group.

group_name (str):

The name of the IAM group whose attached policies are to be listed.

path_prefix (str, optional):

The path prefix for filtering the results.

entity_filter (str, optional):

The entity type to filter the results by. Valid values are ‘User’, ‘Group’, or ‘Role’.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_attached_group_policies mygroup

saltext.boto3.modules.boto3_iam.list_attached_role_policies(role_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List managed policies attached to the given role.

role_name (str):

The name of the IAM role whose attached policies are to be listed.

path_prefix (str, optional):

The path prefix for filtering the results.

entity_filter (str, optional):

The entity type to filter the results by. Valid values are ‘User’, ‘Group’, or ‘Role’.

region (str, optional):

The AWS region where the managed policy is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_attached_role_policies myrole

saltext.boto3.modules.boto3_iam.create_saml_provider(name, saml_metadata_document, region=None, key=None, keyid=None, profile=None)

Create SAML provider.

name (str):

The name of the SAML provider to create.

saml_metadata_document (str):

The SAML metadata document for the provider.

region (str, optional):

The AWS region where the SAML provider is to be created.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.create_saml_provider name saml_metadata_document

saltext.boto3.modules.boto3_iam.get_saml_provider_arn(name, region=None, key=None, keyid=None, profile=None)

Get SAML provider ARN.

name (str):

The name of the SAML provider whose ARN is to be retrieved.

region (str, optional):

The AWS region where the SAML provider is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_saml_provider_arn my_saml_provider_name

saltext.boto3.modules.boto3_iam.delete_saml_provider(name, region=None, key=None, keyid=None, profile=None)

Delete SAML provider.

name (str):

The name of the SAML provider to delete.

region (str, optional):

The AWS region where the SAML provider is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.delete_saml_provider my_saml_provider_name

saltext.boto3.modules.boto3_iam.list_saml_providers(region=None, key=None, keyid=None, profile=None)

List SAML provider names.

region (str, optional):

The AWS region where the SAML providers are located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.list_saml_providers

saltext.boto3.modules.boto3_iam.get_saml_provider(name, region=None, key=None, keyid=None, profile=None)

Get SAML provider metadata document.

name (str):

The name of the SAML provider whose metadata document is to be retrieved. name may be a provider ARN.

region (str, optional):

The AWS region where the SAML provider is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.get_saml_provider arn

saltext.boto3.modules.boto3_iam.update_saml_provider(name, saml_metadata_document, region=None, key=None, keyid=None, profile=None)

Update SAML provider.

name (str):

The name of the SAML provider to update.

saml_metadata_document (str):

The new SAML metadata document for the provider.

region (str, optional):

The AWS region where the SAML provider is located.

key (str, optional):

The AWS secret access key.

keyid (str, optional):

The AWS access key ID.

profile (str, optional):

The profile to use for AWS credentials.

CLI Example:

salt myminion boto3_iam.update_saml_provider name saml_metadata_document