IAM

Users, roles, policies, access keys, and instance profiles. Policy evaluation is off by default; set AUTH=true to enforce it and to verify the SigV4 signatures of IAM user and STS session keys.

Query (form-encoded) multi-tenant 113 operations

Quick start

import boto3
iam = boto3.client("iam", endpoint_url="http://localhost:4566",
                   region_name="us-east-1",
                   aws_access_key_id="test", aws_secret_access_key="test")
iam.create_role(RoleName="r", AssumeRolePolicyDocument="{}")
print(iam.get_role(RoleName="r")["Role"]["Arn"])

Supported operations

113 operations exposed by this service as of MiniStack 1.5.31. Extracted directly from the handler dispatch in the source module.

AddRoleToInstanceProfile AddUserToGroup AttachGroupPolicy AttachRolePolicy AttachUserPolicy CreateAccessKey CreateAccountAlias CreateGroup CreateInstanceProfile CreateLoginProfile CreateOpenIDConnectProvider CreatePolicy CreatePolicyVersion CreateRole CreateSAMLProvider CreateServiceLinkedRole CreateUser CreateVirtualMFADevice DeactivateMFADevice DeleteAccessKey DeleteAccountAlias DeleteAccountPasswordPolicy DeleteGroup DeleteGroupPolicy DeleteInstanceProfile DeleteLoginProfile DeleteOpenIDConnectProvider DeletePolicy DeletePolicyVersion DeleteRole DeleteRolePermissionsBoundary DeleteRolePolicy DeleteSAMLProvider DeleteServiceLinkedRole DeleteUser DeleteUserPermissionsBoundary DeleteUserPolicy DeleteVirtualMFADevice DetachGroupPolicy DetachRolePolicy DetachUserPolicy EnableMFADevice GenerateCredentialReport GenerateServiceLastAccessedDetails GetAccessKeyLastUsed GetAccountAuthorizationDetails GetAccountPasswordPolicy GetAccountSummary GetCredentialReport GetGroup GetGroupPolicy GetInstanceProfile GetLoginProfile GetOpenIDConnectProvider GetPolicy GetPolicyVersion GetRole GetRolePolicy GetSAMLProvider GetServiceLastAccessedDetails GetServiceLinkedRoleDeletionStatus GetUser GetUserPolicy ListAccessKeys ListAccountAliases ListAttachedGroupPolicies ListAttachedRolePolicies ListAttachedUserPolicies ListEntitiesForPolicy ListGroupPolicies ListGroups ListGroupsForUser ListInstanceProfiles ListInstanceProfilesForRole ListInstanceProfileTags ListMFADevices ListOpenIDConnectProviders ListPolicies ListPolicyTags ListPolicyVersions ListRolePolicies ListRoles ListRoleTags ListSAMLProviders ListUserPolicies ListUsers ListUserTags ListVirtualMFADevices PutGroupPolicy PutRolePermissionsBoundary PutRolePolicy PutUserPermissionsBoundary PutUserPolicy RemoveRoleFromInstanceProfile RemoveUserFromGroup ResyncMFADevice SimulateCustomPolicy SimulatePrincipalPolicy TagInstanceProfile TagPolicy TagRole TagUser UntagInstanceProfile UntagPolicy UntagRole UntagUser UpdateAccessKey UpdateAccountPasswordPolicy UpdateAssumeRolePolicy UpdateLoginProfile UpdateRole UpdateRoleDescription UpdateSAMLProvider

CloudFormation

The CloudFormation engine provisions these resource types via this service:

AWS::IAM::InstanceProfile AWS::IAM::ManagedPolicy AWS::IAM::Policy AWS::IAM::Role

See CloudFormation engine for intrinsic support and lifecycle details.

Known limitations

IAM policies are not evaluated by default — every request succeeds. Set AUTH=true to evaluate the caller's policies and return 403 AccessDenied on a disallowed action; it also verifies the signature, session token and request time of requests signed with an IAM user or STS session key, while root keys (test, the server's AWS_ACCESS_KEY_ID or a 12-digit account ID) accept any secret.
SimulatePrincipalPolicy / SimulateCustomPolicy evaluate the supplied or attached policies (allowed / implicitDeny / explicitDeny); condition-key coverage matches the AUTH=true evaluator, not the full simulator.

Source

ministack/services/iam.py

Read the source to verify the ops list above — dispatch tables and handler functions are the ground truth.

See also: all services · configuration · limitations.