Adds the specified user to the specified group.

Changes the password of the IAM user calling ChangePassword . The root account password is not affected by this action. For information about modifying passwords, see Managing Passwords.

Creates a new AWS Secret Access Key and corresponding AWS Access Key ID for the specified user. The default status for new keys is Active .

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

For information about limits on the number of keys you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

IMPORTANT:To ensure the security of your AWS account, the Secret Access Key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.

Creates a new AWS Secret Access Key and corresponding AWS Access Key ID for the specified user. The default status for new keys is Active .

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

For information about limits on the number of keys you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

IMPORTANT:To ensure the security of your AWS account, the Secret Access Key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.

This action creates an alias for your AWS account. For information about using an AWS account alias, see Using an Alias for Your AWS Account ID in Using AWS Identity and Access Management .

Creates a new group.

For information about the number of groups you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Creates a password for the specified user, giving the user the ability to access AWS services through the AWS Management Console. For more information about managing passwords, see Managing Passwords in Using IAM .

Creates a new user for your AWS account.

For information about limitations on the number of users you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Creates a new virtual MFA device for the AWS account. After creating the virtual MFA, use EnableMFADevice to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, go to Using a Virtual MFA Device in Using AWS Identity and Access Management .

For information about limits on the number of MFA devices you can create, see Limitations on Entities in Using AWS Identity and Access Management .

IMPORTANT:The seed information contained in the QR code and the Base32 string should be treated like any other secret access information, such as your AWS access keys or your passwords. After you provision your virtual device, you should ensure that the information is destroyed following secure procedures.

Deactivates the specified MFA device and removes it from association with the user name for which it was originally enabled.

Deletes the access key associated with the specified user.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

Deletes the specified AWS account alias. For information about using an AWS account alias, see Using an Alias for Your AWS Account ID in Using AWS Identity and Access Management .

Deletes the password policy for the AWS account.

Deletes the password policy for the AWS account.

Deletes the specified group. The group must not contain any users or have any attached policies.

Deletes the specified policy that is associated with the specified group.

Deletes the password for the specified user, which terminates the user's ability to access AWS services through the AWS Management Console.

IMPORTANT:Deleting a user's password does not prevent a user from accessing IAM through the command line interface or the API. To prevent all user access you must also either make the access key inactive or delete it. For more information about making keys inactive or deleting them, see UpdateAccessKey and DeleteAccessKey.

Deletes the specified server certificate.

IMPORTANT:If you are using a server certificate with Elastic Load Balancing, deleting the certificate could have implications for your application. If Elastic Load Balancing doesn't detect the deletion of bound certificates, it may continue to use the certificates. This could cause Elastic Load Balancing to stop accepting traffic. We recommend that you remove the reference to the certificate from Elastic Load Balancing before using this command to delete the certificate. For more information, go to DeleteLoadBalancerListeners in the Elastic Load Balancing API Reference.

Deletes the specified signing certificate associated with the specified user.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

Deletes the specified user. The user must not belong to any groups, have any keys or signing certificates, or have any attached policies.

Deletes the specified policy associated with the specified user.

Deletes a virtual MFA device.

NOTE:You must deactivate a user's virtual MFA device before you can delete it. For information about deactivating MFA devices, see DeactivateMFADevice.

Enables the specified MFA device and associates it with the specified user name. When enabled, the MFA device is required for every subsequent login by the user name associated with the device.

Retrieves the password policy for the AWS account. For more information about using a password policy, go to Managing an IAM Password Policy.

Retrieves the password policy for the AWS account. For more information about using a password policy, go to Managing an IAM Password Policy.

Retrieves account level information about account entity usage and IAM quotas.

For information about limitations on IAM entities, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Retrieves account level information about account entity usage and IAM quotas.

For information about limitations on IAM entities, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Returns a list of users that are in the specified group. You can paginate the results using the MaxItems and Marker parameters.

Retrieves the specified policy document for the specified group. The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html.

Retrieves the user name and password create date for the specified user.

Retrieves information about the specified server certificate.

Retrieves information about the specified user, including the user's path, GUID, and ARN.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request.

Retrieves information about the specified user, including the user's path, GUID, and ARN.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request.

Retrieves the specified policy document for the specified user. The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html.

Returns information about the Access Key IDs associated with the specified user. If there are none, the action returns an empty list.

Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

NOTE:To ensure the security of your AWS account, the secret access key is accessible only during key and user creation.

Returns information about the Access Key IDs associated with the specified user. If there are none, the action returns an empty list.

Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

NOTE:To ensure the security of your AWS account, the secret access key is accessible only during key and user creation.

Lists the account aliases associated with the account. For information about using an AWS account alias, see Using an Alias for Your AWS Account ID in Using AWS Identity and Access Management .

You can paginate the results using the MaxItems and Marker parameters.

Lists the account aliases associated with the account. For information about using an AWS account alias, see Using an Alias for Your AWS Account ID in Using AWS Identity and Access Management .

You can paginate the results using the MaxItems and Marker parameters.

Lists the names of the policies associated with the specified group. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the groups that have the specified path prefix.

You can paginate the results using the MaxItems and Marker parameters.

Lists the groups that have the specified path prefix.

You can paginate the results using the MaxItems and Marker parameters.

Lists the groups the specified user belongs to.

You can paginate the results using the MaxItems and Marker parameters.

Lists the MFA devices. If the request includes the user name, then this action lists all the MFA devices associated with the specified user name. If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request.

You can paginate the results using the MaxItems and Marker parameters.

Lists the MFA devices. If the request includes the user name, then this action lists all the MFA devices associated with the specified user name. If you do not specify a user name, IAM determines the user name implicitly based on the AWS Access Key ID signing the request.

You can paginate the results using the MaxItems and Marker parameters.

Lists the server certificates that have the specified path prefix. If none exist, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the server certificates that have the specified path prefix. If none exist, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Returns information about the signing certificates associated with the specified user. If there are none, the action returns an empty list.

Although each user is limited to a small number of signing certificates, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the user name is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

Returns information about the signing certificates associated with the specified user. If there are none, the action returns an empty list.

Although each user is limited to a small number of signing certificates, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the user name is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

Lists the names of the policies associated with the specified user. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the users that have the specified path prefix. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the users that have the specified path prefix. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the virtual MFA devices under the AWS account by assignment status. If you do not specify an assignment status, the action returns a list of all virtual MFA devices. Assignment status can be Assigned , Unassigned , or Any .

You can paginate the results using the MaxItems and Marker parameters.

Lists the virtual MFA devices under the AWS account by assignment status. If you do not specify an assignment status, the action returns a list of all virtual MFA devices. Assignment status can be Assigned , Unassigned , or Any .

You can paginate the results using the MaxItems and Marker parameters.

Adds (or updates) a policy document associated with the specified group. For information about policies, refer to Overview of Policies in Using AWS Identity and Access Management .

For information about limits on the number of policies you can associate with a group, see Limitations on IAM Entities in Using AWS Identity and Access Management .

NOTE:Because policy documents can be large, you should use POST rather than GET when calling PutGroupPolicy. For more information, see Making Query Requests in Using AWS Identity and Access Management.

Adds (or updates) a policy document associated with the specified user. For information about policies, refer to Overview of Policies in Using AWS Identity and Access Management .

For information about limits on the number of policies you can associate with a user, see Limitations on IAM Entities in Using AWS Identity and Access Management .

NOTE:Because policy documents can be large, you should use POST rather than GET when calling PutUserPolicy. For more information, see Making Query Requests in Using AWS Identity and Access Management.

Removes the specified user from the specified group.

Synchronizes the specified MFA device with AWS servers.

Changes the status of the specified access key from Active to Inactive, or vice versa. This action can be used to disable a user's key as part of a key rotation work flow.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

For information about rotating keys, see Managing Keys and Certificates in Using AWS Identity and Access Management .

Updates the password policy settings for the account. For more information about using a password policy, go to Managing an IAM Password Policy.

Updates the password policy settings for the account. For more information about using a password policy, go to Managing an IAM Password Policy.

Updates the name and/or the path of the specified group.

IMPORTANT: You should understand the implications of changing a group's path or name. For more information, see Renaming Users and Groups in Using AWS Identity and Access Management.

NOTE:To change a group name the requester must have appropriate permissions on both the source object and the target object. For example, to change Managers to MGRs, the entity making the request must have permission on Managers and MGRs, or must have permission on all (*). For more information about permissions, see Permissions and Policies.

Changes the password for the specified user.

Updates the name and/or the path of the specified server certificate.

IMPORTANT: You should understand the implications of changing a server certificate's path or name. For more information, see Managing Server Certificates in Using AWS Identity and Access Management.

NOTE:To change a server certificate name the requester must have appropriate permissions on both the source object and the target object. For example, to change the name from ProductionCert to ProdCert, the entity making the request must have permission on ProductionCert and ProdCert, or must have permission on all (*). For more information about permissions, see Permissions and Policies.

Changes the status of the specified signing certificate from active to disabled, or vice versa. This action can be used to disable a user's signing certificate as part of a certificate rotation work flow.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

For information about rotating certificates, see Managing Keys and Certificates in Using AWS Identity and Access Management .

Updates the name and/or the path of the specified user.

IMPORTANT: You should understand the implications of changing a user's path or name. For more information, see Renaming Users and Groups in Using AWS Identity and Access Management.

NOTE:To change a user name the requester must have appropriate permissions on both the source object and the target object. For example, to change Bob to Robert, the entity making the request must have permission on Bob and Robert, or must have permission on all (*). For more information about permissions, see Permissions and Policies.

Uploads a server certificate entity for the AWS account. The server certificate entity includes a public key certificate, a private key, and an optional certificate chain, which should all be PEM-encoded.

For information about the number of server certificates you can upload, see Limitations on IAM Entities in Using AWS Identity and Access Management .

NOTE:Because the body of the public key certificate, private key, and the certificate chain can be large, you should use POST rather than GET when calling UploadServerCertificate. For more information, see Making Query Requests in Using AWS Identity and Access Management.

Uploads an X.509 signing certificate and associates it with the specified user. Some AWS services use X.509 signing certificates to validate requests that are signed with a corresponding private key. When you upload the certificate, its default status is Active .

If the UserName field is not specified, the user name is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

NOTE:Because the body of a X.509 certificate can be large, you should use POST rather than GET when calling UploadSigningCertificate. For more information, see Making Query Requests in Using AWS Identity and Access Management.