IAM

Users, roles, policies, access keys, and instance profiles. Policy evaluation is off by default; set AUTH=true to enforce it (SigV4 is never validated).

Query (form-encoded) multi-tenant 111 operations

Quick start

import boto3
iam = boto3.client("iam", endpoint_url="http://localhost:4566",
                   region_name="us-east-1",
                   aws_access_key_id="test", aws_secret_access_key="test")
iam.create_role(RoleName="r", AssumeRolePolicyDocument="{}")
print(iam.get_role(RoleName="r")["Role"]["Arn"])

Supported operations

111 operations exposed by this service as of MiniStack 1.5.9. Extracted directly from the handler dispatch in the source module.

AddRoleToInstanceProfile AddUserToGroup AttachGroupPolicy AttachRolePolicy AttachUserPolicy CreateAccessKey CreateAccountAlias CreateGroup CreateInstanceProfile CreateLoginProfile CreateOpenIDConnectProvider CreatePolicy CreatePolicyVersion CreateRole CreateSAMLProvider CreateServiceLinkedRole CreateUser CreateVirtualMFADevice DeactivateMFADevice DeleteAccessKey DeleteAccountAlias DeleteAccountPasswordPolicy DeleteGroup DeleteGroupPolicy DeleteInstanceProfile DeleteLoginProfile DeleteOpenIDConnectProvider DeletePolicy DeletePolicyVersion DeleteRole DeleteRolePermissionsBoundary DeleteRolePolicy DeleteSAMLProvider DeleteServiceLinkedRole DeleteUser DeleteUserPolicy DeleteVirtualMFADevice DetachGroupPolicy DetachRolePolicy DetachUserPolicy EnableMFADevice GenerateCredentialReport GenerateServiceLastAccessedDetails GetAccessKeyLastUsed GetAccountAuthorizationDetails GetAccountPasswordPolicy GetAccountSummary GetCredentialReport GetGroup GetGroupPolicy GetInstanceProfile GetLoginProfile GetOpenIDConnectProvider GetPolicy GetPolicyVersion GetRole GetRolePolicy GetSAMLProvider GetServiceLastAccessedDetails GetServiceLinkedRoleDeletionStatus GetUser GetUserPolicy ListAccessKeys ListAccountAliases ListAttachedGroupPolicies ListAttachedRolePolicies ListAttachedUserPolicies ListEntitiesForPolicy ListGroupPolicies ListGroups ListGroupsForUser ListInstanceProfiles ListInstanceProfilesForRole ListInstanceProfileTags ListMFADevices ListOpenIDConnectProviders ListPolicies ListPolicyTags ListPolicyVersions ListRolePolicies ListRoles ListRoleTags ListSAMLProviders ListUserPolicies ListUsers ListUserTags ListVirtualMFADevices PutGroupPolicy PutRolePermissionsBoundary PutRolePolicy PutUserPolicy RemoveRoleFromInstanceProfile RemoveUserFromGroup ResyncMFADevice SimulateCustomPolicy SimulatePrincipalPolicy TagInstanceProfile TagPolicy TagRole TagUser UntagInstanceProfile UntagPolicy UntagRole UntagUser UpdateAccessKey UpdateAccountPasswordPolicy UpdateAssumeRolePolicy UpdateLoginProfile UpdateRole UpdateRoleDescription UpdateSAMLProvider

CloudFormation

The CloudFormation engine provisions these resource types via this service:

AWS::IAM::InstanceProfile AWS::IAM::ManagedPolicy AWS::IAM::Policy AWS::IAM::Role

See CloudFormation engine for intrinsic support and lifecycle details.

Known limitations

IAM policies are not evaluated by default — every request succeeds. Set AUTH=true to evaluate the caller's policies and return 403 AccessDenied on a disallowed action (SigV4 signatures are never validated either way).
SimulatePrincipalPolicy / SimulateCustomPolicy evaluate the supplied or attached policies (allowed / implicitDeny / explicitDeny); condition-key coverage matches the AUTH=true evaluator, not the full simulator.

Source

ministack/services/iam.py

Read the source to verify the ops list above — dispatch tables and handler functions are the ground truth.

See also: all services · configuration · limitations.