Amazon IAM

Manage who can do what in your AWS account from a workflow: create IAM users, tag them, put them in groups and attach managed policies, then take it all away again when someone leaves. Look up users, groups, roles and policies, and suspend or restore a user's access keys.

Actions

Action	What it does
Add user to group	Add an IAM user to a group, giving it the group's permissions.
Attach policy to user	Attach a managed policy to an IAM user, granting what it allows.
Create a group	Create an empty IAM group.
Create a user	Create an IAM user.
Delete a group	Permanently delete an IAM group.
Delete a user	Permanently delete an IAM user.
Detach policy from user	Detach a managed policy from an IAM user.
Get a group	Get an IAM group and a page of the users in it.
Get a role	Get one IAM role: its trust policy, tags, permissions boundary and when it was last used.
Get a user	Get one IAM user with its tags and permissions boundary.
List a user's groups	List the IAM groups a user belongs to.
List a user's policies	List the managed policies attached directly to an IAM user.
List access keys	List a user's access keys: ID, status and creation date.
List groups	List the IAM groups in the account, one page at a time.
List policies	List managed policies: AWS's own, the ones made in this account, or both.
List roles	List the IAM roles in the account, including AWS's own service-linked roles.
List users	List the IAM users in the account, one page at a time.
Remove user from group	Remove an IAM user from a group.
Tag a user	Add tags to an IAM user.
Update an access key	Activate or deactivate a user's access key, for example to suspend a leaked key without deleting it.

Add user to group

Add an IAM user to a group, giving it the group's permissions. A user can be in up to 10 groups.

Inputs

Groupgroup_nametextRequired: The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

Outputs

addedtrue/false
group_nametext
user_nametext

Example output

{
  "added": true,
  "group_name": "developers",
  "user_name": "alice"
}

Attach policy to user

Attach a managed policy to an IAM user, granting what it allows. A user can have up to 10 managed policies.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
Policy ARNpolicy_arntextRequired: The managed policy's ARN, or the link to its page in the IAM console. 'List policies' shows them.

Outputs

attachedtrue/false
policy_arntext
user_nametext

Example output

{
  "attached": true,
  "policy_arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
  "user_name": "alice"
}

Create a group

Create an empty IAM group. Attach policies to it in the IAM console, then add users with 'Add user to group'.

Inputs

Group namegroup_nametextRequired: Up to 128 letters, digits and _+=,.@- with no spaces. Must be unique in the account, ignoring case.
Pathpathtext: An optional path to organise it under, such as '/engineering/'. Leave empty for '/'.

Outputs

arntext
create_datetext
group_idtext
group_nametext
pathtext

Example output

{
  "arn": "arn:aws:iam::123456789012:group/developers",
  "create_date": "2026-09-01T09:00:00+00:00",
  "group_id": "AGPACKCEVSQ6C2EXAMPLE",
  "group_name": "developers",
  "path": "/"
}

Create a user

Create an IAM user. It starts with no console password, no access keys and no permissions; add it to a group or attach a policy to grant some.

Inputs

User nameuser_nametextRequired: Up to 64 letters, digits and _+=,.@- with no spaces. Must be unique in the account, ignoring case.
Pathpathtext: An optional path to organise it under, such as '/engineering/'. Leave empty for '/'.
Tagstagsobject: Tag names and values, such as team = platform. Up to 50 tags; names up to 128 characters, values up to 256.
Permissions boundarypermissions_boundarytext: Optional ARN of a managed policy that caps what this user can ever be allowed to do.

Outputs

arntext
create_datetext
password_last_usedtext
pathtext
permissions_boundary_arntext
tagsobject: Tag key to tag value.
user_idtext
user_nametext

Example output

{
  "arn": "arn:aws:iam::123456789012:user/alice",
  "create_date": "2026-09-01T09:00:00+00:00",
  "password_last_used": null,
  "path": "/",
  "permissions_boundary_arn": null,
  "tags": {
    "team": "platform"
  },
  "user_id": "AIDACKCEVSQ6C2EXAMPLE",
  "user_name": "alice"
}

Delete a group

Permanently delete an IAM group. AWS refuses while it still has members or attached policies.

Inputs

Groupgroup_nametextRequired: The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.

Outputs

deletedtrue/false
group_nametext

Example output

{
  "deleted": true,
  "group_name": "developers"
}

Delete a user

Permanently delete an IAM user. AWS refuses while anything is still attached: remove it from its groups and detach its policies first, and delete its access keys and password in the console.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

Outputs

deletedtrue/false
user_nametext

Example output

{
  "deleted": true,
  "user_name": "alice"
}

Detach policy from user

Detach a managed policy from an IAM user. The policy itself is kept.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
Policy ARNpolicy_arntextRequired: The managed policy's ARN, or the link to its page in the IAM console. 'List policies' shows them.

Outputs

detachedtrue/false
policy_arntext
user_nametext

Example output

{
  "detached": true,
  "policy_arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
  "user_name": "alice"
}

Get a group

Get an IAM group and a page of the users in it.

Inputs

Groupgroup_nametextRequired: The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
groupobject
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.
userslist

Example output

{
  "count": 1,
  "group": {
    "arn": "arn:aws:iam::123456789012:group/developers",
    "create_date": "2026-09-01T09:00:00+00:00",
    "group_id": "AGPACKCEVSQ6C2EXAMPLE",
    "group_name": "developers",
    "path": "/"
  },
  "is_truncated": false,
  "next_marker": null,
  "users": [
    {
      "arn": "arn:aws:iam::123456789012:user/alice",
      "create_date": "2026-09-01T09:00:00+00:00",
      "password_last_used": null,
      "path": "/",
      "user_id": "AIDACKCEVSQ6C2EXAMPLE",
      "user_name": "alice"
    }
  ]
}

Get a role

Get one IAM role: its trust policy, tags, permissions boundary and when it was last used.

Inputs

Role namerole_nametextRequired: The IAM role. Give its name, its ARN, or the link to its page in the IAM console. 'List roles' shows every role.

Outputs

arntext
assume_role_policy_documentobject: The trust policy: who may assume this role.
create_datetext
descriptiontext
last_used_datetext
last_used_regiontext
max_session_durationnumber
pathtext
permissions_boundary_arntext
role_idtext
role_nametext
tagsobject: Tag key to tag value.

Example output

{
  "arn": "arn:aws:iam::123456789012:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport",
  "assume_role_policy_document": {
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
          "Service": "support.amazonaws.com"
        }
      }
    ],
    "Version": "2012-10-17"
  },
  "create_date": "2026-09-01T09:00:00+00:00",
  "description": "Enables resource access for AWS to provide billing support.",
  "last_used_date": null,
  "last_used_region": null,
  "max_session_duration": 3600,
  "path": "/aws-service-role/support.amazonaws.com/",
  "permissions_boundary_arn": null,
  "role_id": "AROACKCEVSQ6C2EXAMPLE",
  "role_name": "AWSServiceRoleForSupport",
  "tags": {}
}

Get a user

Get one IAM user with its tags and permissions boundary. Leave the name empty to get the user this connection signs in as.

Inputs

User nameuser_nametext: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. Leave empty for the user whose access key this connection uses.

Outputs

arntext
create_datetext
password_last_usedtext
pathtext
permissions_boundary_arntext
tagsobject: Tag key to tag value.
user_idtext
user_nametext

Example output

{
  "arn": "arn:aws:iam::123456789012:user/alice",
  "create_date": "2026-09-01T09:00:00+00:00",
  "password_last_used": null,
  "path": "/",
  "permissions_boundary_arn": null,
  "tags": {
    "team": "platform"
  },
  "user_id": "AIDACKCEVSQ6C2EXAMPLE",
  "user_name": "alice"
}

List a user's groups

List the IAM groups a user belongs to.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
groupslist
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.

Example output

{
  "count": 1,
  "groups": [
    {
      "arn": "arn:aws:iam::123456789012:group/developers",
      "create_date": "2026-09-01T09:00:00+00:00",
      "group_id": "AGPACKCEVSQ6C2EXAMPLE",
      "group_name": "developers",
      "path": "/"
    }
  ],
  "is_truncated": false,
  "next_marker": null
}

List a user's policies

List the managed policies attached directly to an IAM user. Policies it gets through its groups are not included.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
Path prefixpath_prefixtext: Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.
policieslist

Example output

{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "policies": [
    {
      "policy_arn": "arn:aws:iam::aws:policy/IAMUserChangePassword",
      "policy_name": "IAMUserChangePassword"
    }
  ]
}

List access keys

List a user's access keys: ID, status and creation date. AWS never shows a secret access key again after it is created.

Inputs

User nameuser_nametext: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. Leave empty for the user whose access key this connection uses.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

access_keyslist
countnumber
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.

Example output

{
  "access_keys": [
    {
      "access_key_id": "AKIAIOSFODNN7EXAMPLE",
      "create_date": "2026-09-01T09:00:00+00:00",
      "status": "Active",
      "user_name": "alice"
    }
  ],
  "count": 1,
  "is_truncated": false,
  "next_marker": null
}

List groups

List the IAM groups in the account, one page at a time.

Inputs

Path prefixpath_prefixtext: Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
groupslist
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.

Example output

{
  "count": 1,
  "groups": [
    {
      "arn": "arn:aws:iam::123456789012:group/developers",
      "create_date": "2026-09-01T09:00:00+00:00",
      "group_id": "AGPACKCEVSQ6C2EXAMPLE",
      "group_name": "developers",
      "path": "/"
    }
  ],
  "is_truncated": false,
  "next_marker": null
}

List policies

List managed policies: AWS's own, the ones made in this account, or both. AWS manages over a thousand, so narrow it with the filters or page through.

Inputs

Scopescopetext: Whose policies to list.One of: All (All policies), AWS (AWS managed only), Local (Customer managed only (this account's own)). Default: All.
Only attachedonly_attachedtrue/false: Only list policies attached to at least one user, group or role.Default: false.
Used aspolicy_usage_filtertext: Only list policies used this way. Leave empty for both.One of: PermissionsPolicy (Used as a permissions policy), PermissionsBoundary (Used as a permissions boundary).
Path prefixpath_prefixtext: Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.
policieslist

Example output

{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "policies": [
    {
      "arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
      "attachment_count": 0,
      "create_date": "2015-02-06T18:39:48+00:00",
      "default_version_id": "v120",
      "description": null,
      "is_attachable": true,
      "path": "/",
      "permissions_boundary_usage_count": 0,
      "policy_id": "ANPAILL3HVNFSB6DCOWYQ",
      "policy_name": "ReadOnlyAccess",
      "update_date": "2026-08-20T17:12:05+00:00"
    }
  ]
}

List roles

List the IAM roles in the account, including AWS's own service-linked roles. Tags, permissions boundaries and last use are not included; use 'Get a role' for those.

Inputs

Path prefixpath_prefixtext: Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.
roleslist

Example output

{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "roles": [
    {
      "arn": "arn:aws:iam::123456789012:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport",
      "assume_role_policy_document": {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "support.amazonaws.com"
            }
          }
        ],
        "Version": "2012-10-17"
      },
      "create_date": "2026-09-01T09:00:00+00:00",
      "description": "Enables resource access for AWS to provide billing support.",
      "max_session_duration": 3600,
      "path": "/aws-service-role/support.amazonaws.com/",
      "role_id": "AROACKCEVSQ6C2EXAMPLE",
      "role_name": "AWSServiceRoleForSupport"
    }
  ]
}

List users

List the IAM users in the account, one page at a time. Tags and permissions boundaries are not included; use 'Get a user' for those.

Inputs

Path prefixpath_prefixtext: Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
Markermarkertext: To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber: How many to return in one page, from 1 to 1,000.From 1 to 1000. Default: 100.

Outputs

countnumber
is_truncatedtrue/false
next_markertext: Pass this as 'Marker' to fetch the next page. Null on the last page.
userslist

Example output

{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "users": [
    {
      "arn": "arn:aws:iam::123456789012:user/alice",
      "create_date": "2026-09-01T09:00:00+00:00",
      "password_last_used": null,
      "path": "/",
      "user_id": "AIDACKCEVSQ6C2EXAMPLE",
      "user_name": "alice"
    }
  ]
}

Remove user from group

Remove an IAM user from a group.

Inputs

Groupgroup_nametextRequired: The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

Outputs

group_nametext
removedtrue/false
user_nametext

Example output

{
  "group_name": "developers",
  "removed": true,
  "user_name": "alice"
}

Tag a user

Add tags to an IAM user. A tag whose name already exists on the user is overwritten with the new value; other tags are kept.

Inputs

User nameuser_nametextRequired: The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
TagstagsobjectRequired: Tag names and values, such as team = platform. Up to 50 tags; names up to 128 characters, values up to 256.

Outputs

tagsobject: The tags this step wrote.
user_nametext

Example output

{
  "tags": {
    "team": "platform"
  },
  "user_name": "alice"
}

Update an access key

Activate or deactivate a user's access key, for example to suspend a leaked key without deleting it. This step will not deactivate the key this connection itself uses.

Inputs

User nameuser_nametextRequired: The IAM user who owns the key. Give its name, its ARN, or the link to its page in the IAM console. Required, because without it AWS would act on this connection's own keys.
Access key IDaccess_key_idtextRequired: The key to change, such as AKIAIOSFODNN7EXAMPLE. 'List access keys' shows them.
StatusstatustextRequired: What the key should be.One of: Active (Active (the key can sign requests)), Inactive (Inactive (requests signed with it fail)).

Outputs

access_key_idtext
statustext
user_nametext

Example output

{
  "access_key_id": "AKIAIOSFODNN7EXAMPLE",
  "status": "Inactive",
  "user_name": "alice"
}

ActionsCopy Anchor Link

Add user to groupCopy Anchor Link

Inputs

Outputs

Attach policy to userCopy Anchor Link

Inputs

Outputs

Create a groupCopy Anchor Link

Inputs

Outputs

Create a userCopy Anchor Link

Inputs

Outputs

Delete a groupCopy Anchor Link

Inputs

Outputs

Delete a userCopy Anchor Link

Inputs

Outputs

Detach policy from userCopy Anchor Link

Inputs

Outputs

Get a groupCopy Anchor Link

Inputs

Outputs

Get a roleCopy Anchor Link

Inputs

Outputs

Get a userCopy Anchor Link

Inputs

Outputs

List a user's groupsCopy Anchor Link

Inputs

Outputs

List a user's policiesCopy Anchor Link

Inputs

Outputs

List access keysCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List policiesCopy Anchor Link

Inputs

Outputs

List rolesCopy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Remove user from groupCopy Anchor Link

Inputs

Outputs

Tag a userCopy Anchor Link

Inputs

Outputs

Update an access keyCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add user to group

Attach policy to user

Create a group

Create a user

Delete a group

Delete a user

Detach policy from user

Get a group

Get a role

Get a user

List a user's groups

List a user's policies

List access keys

List groups

List policies

List roles

List users

Remove user from group

Tag a user

Update an access key