# Amazon IAM

> Manage who can do what in your AWS account from a workflow: create IAM users, tag them, put them in groups and attach managed policies, then take it all away again when someone leaves. Look up users, groups, roles and policies, and suspend or restore a user's access keys.

App · Compliance & Security · 20 actions. Web page: https://docs.lodol.com/docs/integrations/amazon-iam

## Actions

### Add user to group

Add an IAM user to a group, giving it the group's permissions. A user can be in up to 10 groups.

**Inputs**

- Group (`group_name`, text, required): The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

**Outputs**

- `added` (true/false)
- `group_name` (text)
- `user_name` (text)

**Example output**

```json
{
  "added": true,
  "group_name": "developers",
  "user_name": "alice"
}
```

### Attach policy to user

Attach a managed policy to an IAM user, granting what it allows. A user can have up to 10 managed policies.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
- Policy ARN (`policy_arn`, text, required): The managed policy's ARN, or the link to its page in the IAM console. 'List policies' shows them.

**Outputs**

- `attached` (true/false)
- `policy_arn` (text)
- `user_name` (text)

**Example output**

```json
{
  "attached": true,
  "policy_arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
  "user_name": "alice"
}
```

### Create a group

Create an empty IAM group. Attach policies to it in the IAM console, then add users with 'Add user to group'.

**Inputs**

- Group name (`group_name`, text, required): Up to 128 letters, digits and _+=,.@- with no spaces. Must be unique in the account, ignoring case.
- Path (`path`, text): An optional path to organise it under, such as '/engineering/'. Leave empty for '/'.

**Outputs**

- `arn` (text)
- `create_date` (text)
- `group_id` (text)
- `group_name` (text)
- `path` (text)

**Example output**

```json
{
  "arn": "arn:aws:iam::123456789012:group/developers",
  "create_date": "2026-09-01T09:00:00+00:00",
  "group_id": "AGPACKCEVSQ6C2EXAMPLE",
  "group_name": "developers",
  "path": "/"
}
```

### Create a user

Create an IAM user. It starts with no console password, no access keys and no permissions; add it to a group or attach a policy to grant some.

**Inputs**

- User name (`user_name`, text, required): Up to 64 letters, digits and _+=,.@- with no spaces. Must be unique in the account, ignoring case.
- Path (`path`, text): An optional path to organise it under, such as '/engineering/'. Leave empty for '/'.
- Tags (`tags`, object): Tag names and values, such as team = platform. Up to 50 tags; names up to 128 characters, values up to 256.
- Permissions boundary (`permissions_boundary`, text): Optional ARN of a managed policy that caps what this user can ever be allowed to do.

**Outputs**

- `arn` (text)
- `create_date` (text)
- `password_last_used` (text)
- `path` (text)
- `permissions_boundary_arn` (text)
- `tags` (object): Tag key to tag value.
- `user_id` (text)
- `user_name` (text)

**Example output**

```json
{
  "arn": "arn:aws:iam::123456789012:user/alice",
  "create_date": "2026-09-01T09:00:00+00:00",
  "password_last_used": null,
  "path": "/",
  "permissions_boundary_arn": null,
  "tags": {
    "team": "platform"
  },
  "user_id": "AIDACKCEVSQ6C2EXAMPLE",
  "user_name": "alice"
}
```

### Delete a group

Permanently delete an IAM group. AWS refuses while it still has members or attached policies.

**Inputs**

- Group (`group_name`, text, required): The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.

**Outputs**

- `deleted` (true/false)
- `group_name` (text)

**Example output**

```json
{
  "deleted": true,
  "group_name": "developers"
}
```

### Delete a user

Permanently delete an IAM user. AWS refuses while anything is still attached: remove it from its groups and detach its policies first, and delete its access keys and password in the console.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

**Outputs**

- `deleted` (true/false)
- `user_name` (text)

**Example output**

```json
{
  "deleted": true,
  "user_name": "alice"
}
```

### Detach policy from user

Detach a managed policy from an IAM user. The policy itself is kept.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
- Policy ARN (`policy_arn`, text, required): The managed policy's ARN, or the link to its page in the IAM console. 'List policies' shows them.

**Outputs**

- `detached` (true/false)
- `policy_arn` (text)
- `user_name` (text)

**Example output**

```json
{
  "detached": true,
  "policy_arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
  "user_name": "alice"
}
```

### Get a group

Get an IAM group and a page of the users in it.

**Inputs**

- Group (`group_name`, text, required): The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `group` (object)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.
- `users` (list)

**Example output**

```json
{
  "count": 1,
  "group": {
    "arn": "arn:aws:iam::123456789012:group/developers",
    "create_date": "2026-09-01T09:00:00+00:00",
    "group_id": "AGPACKCEVSQ6C2EXAMPLE",
    "group_name": "developers",
    "path": "/"
  },
  "is_truncated": false,
  "next_marker": null,
  "users": [
    {
      "arn": "arn:aws:iam::123456789012:user/alice",
      "create_date": "2026-09-01T09:00:00+00:00",
      "password_last_used": null,
      "path": "/",
      "user_id": "AIDACKCEVSQ6C2EXAMPLE",
      "user_name": "alice"
    }
  ]
}
```

### Get a role

Get one IAM role: its trust policy, tags, permissions boundary and when it was last used.

**Inputs**

- Role name (`role_name`, text, required): The IAM role. Give its name, its ARN, or the link to its page in the IAM console. 'List roles' shows every role.

**Outputs**

- `arn` (text)
- `assume_role_policy_document` (object): The trust policy: who may assume this role.
- `create_date` (text)
- `description` (text)
- `last_used_date` (text)
- `last_used_region` (text)
- `max_session_duration` (number)
- `path` (text)
- `permissions_boundary_arn` (text)
- `role_id` (text)
- `role_name` (text)
- `tags` (object): Tag key to tag value.

**Example output**

```json
{
  "arn": "arn:aws:iam::123456789012:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport",
  "assume_role_policy_document": {
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
          "Service": "support.amazonaws.com"
        }
      }
    ],
    "Version": "2012-10-17"
  },
  "create_date": "2026-09-01T09:00:00+00:00",
  "description": "Enables resource access for AWS to provide billing support.",
  "last_used_date": null,
  "last_used_region": null,
  "max_session_duration": 3600,
  "path": "/aws-service-role/support.amazonaws.com/",
  "permissions_boundary_arn": null,
  "role_id": "AROACKCEVSQ6C2EXAMPLE",
  "role_name": "AWSServiceRoleForSupport",
  "tags": {}
}
```

### Get a user

Get one IAM user with its tags and permissions boundary. Leave the name empty to get the user this connection signs in as.

**Inputs**

- User name (`user_name`, text): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. Leave empty for the user whose access key this connection uses.

**Outputs**

- `arn` (text)
- `create_date` (text)
- `password_last_used` (text)
- `path` (text)
- `permissions_boundary_arn` (text)
- `tags` (object): Tag key to tag value.
- `user_id` (text)
- `user_name` (text)

**Example output**

```json
{
  "arn": "arn:aws:iam::123456789012:user/alice",
  "create_date": "2026-09-01T09:00:00+00:00",
  "password_last_used": null,
  "path": "/",
  "permissions_boundary_arn": null,
  "tags": {
    "team": "platform"
  },
  "user_id": "AIDACKCEVSQ6C2EXAMPLE",
  "user_name": "alice"
}
```

### List a user's groups

List the IAM groups a user belongs to.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `groups` (list)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.

**Example output**

```json
{
  "count": 1,
  "groups": [
    {
      "arn": "arn:aws:iam::123456789012:group/developers",
      "create_date": "2026-09-01T09:00:00+00:00",
      "group_id": "AGPACKCEVSQ6C2EXAMPLE",
      "group_name": "developers",
      "path": "/"
    }
  ],
  "is_truncated": false,
  "next_marker": null
}
```

### List a user's policies

List the managed policies attached directly to an IAM user. Policies it gets through its groups are not included.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
- Path prefix (`path_prefix`, text): Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.
- `policies` (list)

**Example output**

```json
{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "policies": [
    {
      "policy_arn": "arn:aws:iam::aws:policy/IAMUserChangePassword",
      "policy_name": "IAMUserChangePassword"
    }
  ]
}
```

### List access keys

List a user's access keys: ID, status and creation date. AWS never shows a secret access key again after it is created.

**Inputs**

- User name (`user_name`, text): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. Leave empty for the user whose access key this connection uses.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `access_keys` (list)
- `count` (number)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.

**Example output**

```json
{
  "access_keys": [
    {
      "access_key_id": "AKIAIOSFODNN7EXAMPLE",
      "create_date": "2026-09-01T09:00:00+00:00",
      "status": "Active",
      "user_name": "alice"
    }
  ],
  "count": 1,
  "is_truncated": false,
  "next_marker": null
}
```

### List groups

List the IAM groups in the account, one page at a time.

**Inputs**

- Path prefix (`path_prefix`, text): Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `groups` (list)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.

**Example output**

```json
{
  "count": 1,
  "groups": [
    {
      "arn": "arn:aws:iam::123456789012:group/developers",
      "create_date": "2026-09-01T09:00:00+00:00",
      "group_id": "AGPACKCEVSQ6C2EXAMPLE",
      "group_name": "developers",
      "path": "/"
    }
  ],
  "is_truncated": false,
  "next_marker": null
}
```

### List policies

List managed policies: AWS's own, the ones made in this account, or both. AWS manages over a thousand, so narrow it with the filters or page through.

**Inputs**

- Scope (`scope`, text): Whose policies to list. One of: `All` (All policies), `AWS` (AWS managed only), `Local` (Customer managed only (this account's own)). Default: `All`.
- Only attached (`only_attached`, true/false): Only list policies attached to at least one user, group or role. Default: `false`.
- Used as (`policy_usage_filter`, text): Only list policies used this way. Leave empty for both. One of: `PermissionsPolicy` (Used as a permissions policy), `PermissionsBoundary` (Used as a permissions boundary).
- Path prefix (`path_prefix`, text): Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.
- `policies` (list)

**Example output**

```json
{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "policies": [
    {
      "arn": "arn:aws:iam::aws:policy/ReadOnlyAccess",
      "attachment_count": 0,
      "create_date": "2015-02-06T18:39:48+00:00",
      "default_version_id": "v120",
      "description": null,
      "is_attachable": true,
      "path": "/",
      "permissions_boundary_usage_count": 0,
      "policy_id": "ANPAILL3HVNFSB6DCOWYQ",
      "policy_name": "ReadOnlyAccess",
      "update_date": "2026-08-20T17:12:05+00:00"
    }
  ]
}
```

### List roles

List the IAM roles in the account, including AWS's own service-linked roles. Tags, permissions boundaries and last use are not included; use 'Get a role' for those.

**Inputs**

- Path prefix (`path_prefix`, text): Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.
- `roles` (list)

**Example output**

```json
{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "roles": [
    {
      "arn": "arn:aws:iam::123456789012:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport",
      "assume_role_policy_document": {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": "support.amazonaws.com"
            }
          }
        ],
        "Version": "2012-10-17"
      },
      "create_date": "2026-09-01T09:00:00+00:00",
      "description": "Enables resource access for AWS to provide billing support.",
      "max_session_duration": 3600,
      "path": "/aws-service-role/support.amazonaws.com/",
      "role_id": "AROACKCEVSQ6C2EXAMPLE",
      "role_name": "AWSServiceRoleForSupport"
    }
  ]
}
```

### List users

List the IAM users in the account, one page at a time. Tags and permissions boundaries are not included; use 'Get a user' for those.

**Inputs**

- Path prefix (`path_prefix`, text): Only return entries whose path starts with this, such as '/engineering/'. Leave empty for all.
- Marker (`marker`, text): To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items (`max_items`, number): How many to return in one page, from 1 to 1,000. From 1 to 1000. Default: `100`.

**Outputs**

- `count` (number)
- `is_truncated` (true/false)
- `next_marker` (text): Pass this as 'Marker' to fetch the next page. Null on the last page.
- `users` (list)

**Example output**

```json
{
  "count": 1,
  "is_truncated": false,
  "next_marker": null,
  "users": [
    {
      "arn": "arn:aws:iam::123456789012:user/alice",
      "create_date": "2026-09-01T09:00:00+00:00",
      "password_last_used": null,
      "path": "/",
      "user_id": "AIDACKCEVSQ6C2EXAMPLE",
      "user_name": "alice"
    }
  ]
}
```

### Remove user from group

Remove an IAM user from a group.

**Inputs**

- Group (`group_name`, text, required): The IAM group. Pick one, or give its name, its ARN, or the link to its page in the IAM console.
- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.

**Outputs**

- `group_name` (text)
- `removed` (true/false)
- `user_name` (text)

**Example output**

```json
{
  "group_name": "developers",
  "removed": true,
  "user_name": "alice"
}
```

### Tag a user

Add tags to an IAM user. A tag whose name already exists on the user is overwritten with the new value; other tags are kept.

**Inputs**

- User name (`user_name`, text, required): The IAM user. Give its name, its ARN, or the link to its page in the IAM console. 'List users' shows every user.
- Tags (`tags`, object, required): Tag names and values, such as team = platform. Up to 50 tags; names up to 128 characters, values up to 256.

**Outputs**

- `tags` (object): The tags this step wrote.
- `user_name` (text)

**Example output**

```json
{
  "tags": {
    "team": "platform"
  },
  "user_name": "alice"
}
```

### Update an access key

Activate or deactivate a user's access key, for example to suspend a leaked key without deleting it. This step will not deactivate the key this connection itself uses.

**Inputs**

- User name (`user_name`, text, required): The IAM user who owns the key. Give its name, its ARN, or the link to its page in the IAM console. Required, because without it AWS would act on this connection's own keys.
- Access key ID (`access_key_id`, text, required): The key to change, such as AKIAIOSFODNN7EXAMPLE. 'List access keys' shows them.
- Status (`status`, text, required): What the key should be. One of: `Active` (Active (the key can sign requests)), `Inactive` (Inactive (requests signed with it fail)).

**Outputs**

- `access_key_id` (text)
- `status` (text)
- `user_name` (text)

**Example output**

```json
{
  "access_key_id": "AKIAIOSFODNN7EXAMPLE",
  "status": "Inactive",
  "user_name": "alice"
}
```