IAM

Users, roles, policies, access keys, instance profiles — metadata only (no policy evaluation).

Query (form-encoded) multi-tenant 105 operations

Quick start

import boto3
iam = boto3.client("iam", endpoint_url="http://localhost:4566",
                   region_name="us-east-1",
                   aws_access_key_id="test", aws_secret_access_key="test")
iam.create_role(RoleName="r", AssumeRolePolicyDocument="{}")
print(iam.get_role(RoleName="r")["Role"]["Arn"])

Supported operations

105 operations exposed by this service as of MiniStack 1.4.6. Extracted directly from the handler dispatch in the source module.

AddRoleToInstanceProfile AddUserToGroup AttachGroupPolicy AttachRolePolicy AttachUserPolicy CreateAccessKey CreateAccountAlias CreateGroup CreateInstanceProfile CreateLoginProfile CreateOpenIDConnectProvider CreatePolicy CreatePolicyVersion CreateRole CreateSAMLProvider CreateServiceLinkedRole CreateUser CreateVirtualMFADevice DeactivateMFADevice DeleteAccessKey DeleteAccountAlias DeleteAccountPasswordPolicy DeleteGroup DeleteGroupPolicy DeleteInstanceProfile DeleteLoginProfile DeleteOpenIDConnectProvider DeletePolicy DeletePolicyVersion DeleteRole DeleteRolePolicy DeleteSAMLProvider DeleteServiceLinkedRole DeleteUser DeleteUserPolicy DeleteVirtualMFADevice DetachGroupPolicy DetachRolePolicy DetachUserPolicy EnableMFADevice GenerateCredentialReport GenerateServiceLastAccessedDetails GetAccessKeyLastUsed GetAccountAuthorizationDetails GetAccountPasswordPolicy GetAccountSummary GetCredentialReport GetGroup GetGroupPolicy GetInstanceProfile GetLoginProfile GetOpenIDConnectProvider GetPolicy GetPolicyVersion GetRole GetRolePolicy GetSAMLProvider GetServiceLastAccessedDetails GetServiceLinkedRoleDeletionStatus GetUser GetUserPolicy ListAccessKeys ListAccountAliases ListAttachedGroupPolicies ListAttachedRolePolicies ListAttachedUserPolicies ListEntitiesForPolicy ListGroupPolicies ListGroups ListGroupsForUser ListInstanceProfiles ListInstanceProfilesForRole ListInstanceProfileTags ListMFADevices ListOpenIDConnectProviders ListPolicies ListPolicyTags ListPolicyVersions ListRolePolicies ListRoles ListRoleTags ListSAMLProviders ListUserPolicies ListUsers ListUserTags ListVirtualMFADevices PutGroupPolicy PutRolePolicy PutUserPolicy RemoveRoleFromInstanceProfile RemoveUserFromGroup TagInstanceProfile TagPolicy TagRole TagUser UntagInstanceProfile UntagPolicy UntagRole UntagUser UpdateAccessKey UpdateAccountPasswordPolicy UpdateAssumeRolePolicy UpdateLoginProfile UpdateRole UpdateSAMLProvider

CloudFormation

The CloudFormation engine provisions these resource types via this service:

AWS::IAM::Role AWS::IAM::Policy AWS::IAM::ManagedPolicy AWS::IAM::InstanceProfile

See CloudFormation engine for intrinsic support and lifecycle details.

Known limitations

IAM policies are stored but never evaluated — every request succeeds.
SimulatePrincipalPolicy / SimulateCustomPolicy return a basic allow/deny shape without genuine condition-key evaluation.

Source

ministack/services/iam.py

Read the source to verify the ops list above — dispatch tables and handler functions are the ground truth.

See also: all services · configuration · limitations.