C# (CSharp) Amazon.IdentityManagement.Model Пространство имен

The AccessKey data type contains information about an AWS access key.

This data type is used as a response element in the actions CreateAccessKey and ListAccessKeys.

This data type is used as a response element in the ListAccessKeys action.

This action is idempotent; it does not fail or return an error if you add an existing client ID to the provider.

For more information about roles, go to Working with Roles. For more information about instance profiles, go to About Instance Profiles.

Adds the specified user to the specified group.

You use this API to attach a managed policy to a group. To embed an inline policy in a group, use PutGroupPolicy.

For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

When you attach a managed policy to a role, the managed policy becomes part of the role's permission (access) policy. You cannot use a managed policy as the role's trust policy. The role's trust policy is created at the same time as the role, using CreateRole. You can update a role's trust policy using UpdateAssumeRolePolicy.

Use this API to attach a managed policy to a role. To embed an inline policy in a role, use PutRolePolicy. For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

You use this API to attach a managed policy to a user. To embed an inline policy in a user, use PutUserPolicy.

For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

To change the password for a different user, see UpdateLoginProfile. For more information about modifying passwords, see Managing Passwords in the IAM User Guide.

This data type is used as an input parameter to SimulateCustomPolicy and SimulateCustomPolicy .

Creates a new AWS secret access key and corresponding AWS access key ID for the specified user. The default status for new keys is Active .

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

For information about limits on the number of keys you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

IMPORTANT:To ensure the security of your AWS account, the secret access key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.

This action creates an alias for your AWS account. For information about using an AWS account alias, see Using an Alias for Your AWS Account ID in Using AWS Identity and Access Management .

Creates a new group.

For information about the number of groups you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

For information about the number of instance profiles you can create, see Limitations on IAM Entities in the IAM User Guide.

Creates a login profile for the specified User, giving the User the ability to access AWS services such as the AWS Management Console. For more information about login profiles, see Managing Login Profiles and MFA Devices in Using AWS Identity and Access Management.

NOTE:In the full release you will be able to use IAM to access your services through the AWS Management Console. Although this feature is not currently available, you can create login profiles for your Users now. Then, when this feature is implemented, your Users can use IAM to access your services through the AWS Management Console.

Contains the result of a successful invocation of the CreateLoginProfile action.

The OIDC provider that you create with this operation can be used as a principal in a role's trust policy to establish a trust relationship between AWS and the OIDC provider.

When you create the IAM OIDC provider, you specify the URL of the OIDC identity provider (IdP) to trust, a list of client IDs (also known as audiences) that identify the application or applications that are allowed to authenticate using the OIDC provider, and a list of thumbprints of the server certificate(s) that the IdP uses. You get all of this information from the OIDC IdP that you want to use for access to AWS.

This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version. For more information about policy versions, see Versioning for Managed Policies in the IAM User Guide.

For more information about managed policies in general, see Managed Policies and Inline Policies in the IAM User Guide.

Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached.

For more information about managed policy versions, see Versioning for Managed Policies in the IAM User Guide.

Creates a new role for your AWS account.

For information about limitations on the number of roles you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Contains the result of a successful invocation of the CreateRoleResponse action.

Creates an IAM entity to describe an identity provider (IdP) that supports SAML 2.0.

The SAML provider that you create with this operation can be used as a principal in a role's trust policy to establish a trust relationship between AWS and a SAML identity provider. You can create an IAM role that supports Web-based single sign-on (SSO) to the AWS Management Console or one that supports API access to AWS.

When you create the SAML provider, you upload an a SAML metadata document that you get from your IdP and that includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP.

NOTE:This operation requires Signature Version 4.

For more information, see Giving Console Access Using SAML and Creating Temporary Security Credentials for SAML Federation in the Using Temporary Credentials guide.

You can have a maximum of two sets of service-specific credentials for each supported service per user.

The only supported service at this time is AWS CodeCommit.

You can reset the password to a new service-generated value by calling ResetServiceSpecificCredential.

For more information about service-specific credentials, see Using IAM with AWS CodeCommit: Git Credentials, SSH Keys, and AWS Access Keys in the IAM User Guide.

Creates a new user for your AWS account.

For information about limitations on the number of users you can create, see Limitations on IAM Entities in Using AWS Identity and Access Management .

Contains the result of a successful invocation of the CreateUser action.

For information about limits on the number of MFA devices you can create, see Limitations on Entities in the IAM User Guide.

Contains the result of a successful invocation of the CreateVirtualMFADevice action.

For more information about creating and working with virtual MFA devices, go to Using a Virtual MFA Device in the IAM User Guide.

Deletes the access key associated with the specified User.

If you do not specify a User name, IAM determines the User name implicitly based on the AWS Access Key ID signing the request. Because this action works for access keys under the AWS Account, you can use this API to manage root credentials even if the AWS Account has no associated Users.

Deletes the specified policy that is associated with the specified group.

Deletes the specified group. The group must not contain any Users or have any attached policies.

For more information about instance profiles, go to About Instance Profiles.

Deleting an IAM OIDC provider resource does not update any roles that reference the provider as a principal in their trust policies. Any attempt to assume a role that references a deleted provider fails.

This action is idempotent; it does not fail or return an error if you call the action for a provider that does not exist.

Before you can delete a managed policy, you must first detach the policy from all users, groups, and roles that it is attached to, and you must delete all of the policy's versions. The following steps describe the process for deleting a managed policy:

• Detach the policy from all users, groups, and roles that the policy is attached to, using the DetachUserPolicy, DetachGroupPolicy, or DetachRolePolicy APIs. To list all the users, groups, and roles that a policy is attached to, use ListEntitiesForPolicy.

• Delete all versions of the policy using DeletePolicyVersion. To list the policy's versions, use ListPolicyVersions. You cannot use DeletePolicyVersion to delete the version that is marked as the default version. You delete the policy's default version in the next step of the process.

• Delete the policy (this automatically deletes the policy's default version) using this API.

For information about managed policies, see Managed Policies and Inline Policies in the IAM User Guide.

You cannot delete the default version from a policy using this API. To delete the default version from a policy, use DeletePolicy. To find out which version of a policy is marked as the default version, use ListPolicyVersions.

For information about versions for managed policies, see Versioning for Managed Policies in the IAM User Guide.

Deletes the specified policy associated with the specified role.

Deletes the specified role. The role must not have any policies attached. For more information about roles, go to Working with Roles .

IMPORTANT:Make sure you do not have any Amazon EC2 instances running with the role you are about to delete. Deleting a role or instance profile that is associated with a running instance will break any applications running on the instance.

Deletes a SAML provider.

Deleting the provider does not update any roles that reference the SAML provider as a principal in their trust policies. Any attempt to assume a role that references a SAML provider that has been deleted will fail.

NOTE:This operation requires Signature Version 4.

The SSH public key deleted by this action is used only for authenticating the associated IAM user to an AWS CodeCommit repository. For more information about using SSH keys to authenticate to an AWS CodeCommit repository, see Set up AWS CodeCommit for SSH Connections in the AWS CodeCommit User Guide.

For more information about working with server certificates, including a list of AWS services that can use the server certificates that you manage with IAM, go to Working with Server Certificates in the IAM User Guide.

Deletes the specified signing certificate associated with the specified user.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID signing the request. Because this action works for access keys under the AWS account, you can use this API to manage root credentials even if the AWS account has no associated users.

Deletes the specified policy associated with the specified User.

Deletes the specified user. The user must not belong to any groups, have any keys or signing certificates, or have any attached policies.

Deletes a virtual MFA device.

NOTE:You must deactivate a user's virtual MFA device before you can delete it. For information about deactivating MFA devices, see DeactivateMFADevice.

A group can also have inline policies embedded with it. To delete an inline policy, use the DeleteGroupPolicy API. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

A role can also have inline policies embedded with it. To delete an inline policy, use the DeleteRolePolicy API. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

A user can also have inline policies embedded with it. To delete an inline policy, use the DeleteUserPolicy API. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

This data type is used by the return parameter of SimulateCustomPolicy and SimulatePrincipalPolicy .

You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.

Context keys are variables maintained by AWS and its services that provide details about the context of an API query request, and can be evaluated by testing against a value specified in an IAM policy. Use GetContextKeysForCustomPolicy to understand what key names and values you must supply when you call SimulateCustomPolicy. Note that all parameters are shown in unencoded form here for clarity, but must be URL encoded to be included as a part of a real HTML request.

You can optionally include a list of one or more additional policies, specified as strings. If you want to include only a list of policies by string, use GetContextKeysForCustomPolicy instead.

Note: This API discloses information about the permissions granted to other users. If you do not want users to see other user's permissions, then consider allowing them to use GetContextKeysForCustomPolicy instead.

Context keys are variables maintained by AWS and its services that provide details about the context of an API query request, and can be evaluated by testing against a value in an IAM policy. Use GetContextKeysForPrincipalPolicy to understand what key names and values you must supply when you call SimulatePrincipalPolicy.

Retrieves the specified policy document for the specified group. The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html .

Returns a list of Users that are in the specified group. You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the GetGroup action.

Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, go to About Instance Profiles . For more information about ARNs, go to ARNs .

Contains the result of a successful invocation of the GetInstanceProfileResponse action.

Retrieves the login profile for the specified User.

NOTE:In the full release you will be able to use IAM to access your services through the AWS Management Console. Although this feature is not currently available, you can create login profiles for your Users now. Then, when this feature is implemented, your Users can use IAM to access your services through the AWS Management Console.

Contains the result of a successful invocation of the GetLoginProfile action.

This API retrieves information about managed policies. To retrieve information about an inline policy that is embedded with an IAM user, group, or role, use the GetUserPolicy, GetGroupPolicy, or GetRolePolicy API.

For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

To list the available versions for a policy, use ListPolicyVersions.

This API retrieves information about managed policies. To retrieve information about an inline policy that is embedded in a user, group, or role, use the GetUserPolicy, GetGroupPolicy, or GetRolePolicy API.

For more information about the types of policies, see Managed Policies and Inline Policies in the IAM User Guide.

For more information about managed policy versions, see Versioning for Managed Policies in the IAM User Guide.

Retrieves the specified policy document for the specified role. For more information about roles, go to Working with Roles .

The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html .

Contains the result of a successful invocation of the GetRolePolicyResponse action.

Retrieves information about the specified role, including the role's path, GUID, ARN, and the policy granting permission to EC2 to assume the role. For more information about ARNs, go to ARNs . For more information about roles, go to Working with Roles .

The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html .

Contains the result of a successful invocation of the GetRole action.

Contains the result of a successful invocation of the GetSAMLProvider action.

The SSH public key retrieved by this action is used only for authenticating the associated IAM user to an AWS CodeCommit repository. For more information about using SSH keys to authenticate to an AWS CodeCommit repository, see Set up AWS CodeCommit for SSH Connections in the AWS CodeCommit User Guide.

For more information about working with server certificates, including a list of AWS services that can use the server certificates that you manage with IAM, go to Working with Server Certificates in the IAM User Guide.

Retrieves the specified policy document for the specified User. The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html.

If you do not specify a user name, IAM determines the user name implicitly based on the AWS access key ID used to sign the request to this API.

The Group data type contains information about a group.

This data type is used as a response element in the following actions:

• CreateGroup
• GetGroup
• ListGroups

This data type is used as a response element in the GetAccountAuthorizationDetails action.

The InstanceProfile data type contains information about an instance profile.

This data type is used as a response element in the following actions:

• CreateInstanceProfile

• GetInstanceProfile

• ListInstanceProfiles

• ListInstanceProfilesForRole

Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS access key ID used to sign the request. Because this action works for access keys under the AWS account, you can use this action to manage root credentials even if the AWS account has no associated users.

Contains the result of a successful invocation of the ListAccessKeys action.

Contains the result of a successful invocation of the ListAccountAliases action.

An IAM group can also have inline policies embedded with it. To list the inline policies for a group, use the ListGroupPolicies API. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

You can paginate the results using the MaxItems and Marker parameters. You can use the PathPrefix parameter to limit the list of policies to only those matching the specified path prefix. If there are no policies attached to the specified group (or none that match the specified path prefix), the action returns an empty list.

An IAM user can also have inline policies embedded with it. To list the inline policies for a user, use the ListUserPolicies API. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

You can paginate the results using the MaxItems and Marker parameters. You can use the PathPrefix parameter to limit the list of policies to only those matching the specified path prefix. If there are no policies attached to the specified group (or none that match the specified path prefix), the action returns an empty list.

You can use the optional EntityFilter parameter to limit the results to a particular type of entity (users, groups, or roles). For example, to list only the roles that are attached to the specified policy, set EntityFilter to Role.

You can paginate the results using the MaxItems and Marker parameters.

Lists the names of the policies associated with the specified group. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListGroupPolicies action.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListGroupsForUser action.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListGroups action.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListInstanceProfilesForRoleResponse action.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListInstanceProfiles action.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListMFADevices action.

You can filter the list of policies that is returned using the optional OnlyAttached, Scope, and PathPrefix parameters. For example, to list only the customer managed policies in your AWS account, set Scope to Local. To list only AWS managed policies, set Scope to AWS.

You can paginate the results using the MaxItems and Marker parameters.

For more information about managed policies, see Managed Policies and Inline Policies in the IAM User Guide.

For more information about managed policies, see Managed Policies and Inline Policies in the IAM User Guide.

Lists the names of the policies associated with the specified role. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Lists the roles that have the specified path prefix. If there are none, the action returns an empty list. For more information about roles, go to Working with Roles .

You can paginate the results using the MaxItems and Marker parameters.

The returned policy is URL-encoded according to RFC 3986. For more information about RFC 3986, go to http://www.faqs.org/rfcs/rfc3986.html .

Contains the result of a successful invocation of the ListSAMLProviders action.

Lists the server certificates that have the specified path prefix. If none exist, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListServerCertificates action.

Returns information about the signing certificates associated with the specified user. If there are none, the action returns an empty list.

Although each user is limited to a small number of signing certificates, you can still paginate the results using the MaxItems and Marker parameters.

If the UserName field is not specified, the user name is determined implicitly based on the AWS access key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

Contains the result of a successful invocation of the ListSigningCertificates action.

An IAM user can also have managed policies attached to it. To list the managed policies that are attached to a user, use ListAttachedUserPolicies. For more information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

You can paginate the results using the MaxItems and Marker parameters. If there are no inline policies embedded with the specified user, the action returns an empty list.

Contains the result of a successful invocation of the ListUserPolicies action.

Lists the users that have the specified path prefix. If there are none, the action returns an empty list.

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListUsers action.

Lists the virtual MFA devices under the AWS account by assignment status. If you do not specify an assignment status, the action returns a list of all virtual MFA devices. Assignment status can be Assigned , Unassigned , or Any .

You can paginate the results using the MaxItems and Marker parameters.

Contains the result of a successful invocation of the ListVirtualMFADevices action.

The LoginProfile data type contains information about a login profile for a User.

This data type is used as a response element in the actions CreateLoginProfile and GetLoginProfile.

The MFADevice data type contains information about an MFA device.

This data type is used as a response element in the action ListMFADevices.

This data type is used as a response element in the CreatePolicy, GetPolicy, and ListPolicies actions.

For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.

This data type is used as a response element in the GetAccountAuthorizationDetails action.

For more information about managed policies, see Managed Policies and Inline Policies in the Using IAM guide.

The PasswordPolicy data type contains information about the account password policy.

This data type is used as a response element in the action GetAccountPasswordPolicy.

This data type is used as a response element in the ListEntitiesForPolicy action.

For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.

This data type is used as a response element in the ListEntitiesForPolicy action.

For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.

This data type is used as a response element in the ListEntitiesForPolicy action.

For more information about managed policies, refer to Managed Policies and Inline Policies in the Using IAM guide.

This data type is used as a member of the Statement type.

A user can also have managed policies attached to it. To attach a managed policy to a group, use AttachGroupPolicy. To create a new managed policy, use CreatePolicy. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

For information about limits on the number of inline policies that you can embed in a group, see Limitations on IAM Entities in the IAM User Guide.

When you embed an inline policy in a role, the inline policy is used as part of the role's access (permissions) policy. The role's trust policy is created at the same time as the role, using CreateRole. You can update a role's trust policy using UpdateAssumeRolePolicy. For more information about IAM roles, go to Using Roles to Delegate Permissions and Federate Identities.

A role can also have a managed policy attached to it. To attach a managed policy to a role, use AttachRolePolicy. To create a new managed policy, use CreatePolicy. For information about policies, see Managed Policies and Inline Policies in the IAM User Guide.

For information about limits on the number of inline policies that you can embed with a role, see Limitations on IAM Entities in the IAM User Guide.

Adds (or updates) a policy document associated with the specified User. For information about how to write a policy, refer to Using AWS Identity and Access Management.

For information about limits on the number of policies you can associate with a User, see Limitations on IAM Entities in Using AWS Identity and Access Management.

NOTE:Because policy documents can be large, you should use POST rather than GET when calling PutUserPolicy. For more information, see Using the Query API in Using AWS Identity and Access Management.

This action is idempotent; it does not fail or return an error if you try to remove a client ID that does not exist.

Removes the specified role from the specified instance profile.

Removes the specified User from the specified group.

This data type is used by a member of the EvaluationResult data type.

Synchronizes the specified MFA device with AWS servers.

The Role data type contains information about a role.

This data type is used as a response element in the following actions:

• CreateRole

• GetRole

• ListRoles

This data type is used as a response element in the GetAccountAuthorizationDetails action.

The ServerCertificate data type contains information about a server certificate.

This data type is used as a response element in the action GetServerCertificate.

This data type is used as a response element in the UploadServerCertificate and ListServerCertificates actions.

This action affects all users, groups, and roles that the policy is attached to. To list the users, groups, and roles that the policy is attached to, use the ListEntitiesForPolicy API.

For information about managed policies, see Managed Policies and Inline Policies in the IAM User Guide.

The SigningCertificate data type contains information about an X.509 signing certificate.

This data type is used as a response element in the actions UploadSigningCertificate and ListSigningCertificates.

The simulation does not perform the API actions; it only checks the authorization to determine if the simulated policies allow or deny the actions.

If you want to simulate existing policies attached to an IAM user, group, or role, use SimulatePrincipalPolicy instead.

Context keys are variables maintained by AWS and its services that provide details about the context of an API query request. You can use the Condition element of an IAM policy to evaluate context keys. To get the list of context keys that the policies require for correct simulation, use GetContextKeysForCustomPolicy.

If the output is long, you can use MaxItems and Marker parameters to paginate the results.

You can optionally include a list of one or more additional policies specified as strings to include in the simulation. If you want to simulate only policies specified as strings, use SimulateCustomPolicy instead.

You can also optionally include one resource-based policy to be evaluated with each of the resources included in the simulation.

The simulation does not perform the API actions, it only checks the authorization to determine if the simulated policies allow or deny the actions.

Note: This API discloses information about the permissions granted to other users. If you do not want users to see other user's permissions, then consider allowing them to use SimulateCustomPolicy instead.

Context keys are variables maintained by AWS and its services that provide details about the context of an API query request. You can use the Condition element of an IAM policy to evaluate context keys. To get the list of context keys that the policies require for correct simulation, use GetContextKeysForPrincipalPolicy.

If the output is long, you can use the MaxItems and Marker parameters to paginate the results.

This data type is used by the MatchedStatements member of the EvaluationResult type.

Changes the status of the specified access key from Active to Inactive, or vice versa. This action can be used to disable a user's key as part of a key rotation work flow.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS access key ID used to sign the request. Because this action works for access keys under the AWS account, this API can be used to manage root credentials even if the AWS account has no associated users.

For information about rotating keys, see Managing Keys and Certificates in Using AWS Identity and Access Management .

Updates the password policy settings for the account. For more information about using a password policy, go to Managing an IAM Password Policy .

Updates the policy that grants an entity permission to assume a role. Currently, only an Amazon EC2 instance can assume a role. For more information about roles, go to Working with Roles .

Updates the login profile for the specified User. Use this API to change the User's password.

NOTE:In the full release you will be able to use IAM to access your services through the AWS Management Console. Although this feature is not currently available, you can create login profiles for your Users now. Then, when this feature is implemented, your Users can use IAM to access your services through the AWS Management Console.

The list that you pass with this action completely replaces the existing list of thumbprints. (The lists are not merged.)

Typically, you need to update a thumbprint only when the identity provider's certificate changes, which occurs rarely. However, if the provider's certificate does change, any attempt to assume an IAM role that specifies the OIDC provider as a principal fails until the certificate thumbprint is updated.

Contains the result of a successful invocation of the UpdateSAMLProvider action.

The SSH public key affected by this action is used only for authenticating the associated IAM user to an AWS CodeCommit repository. For more information about using SSH keys to authenticate to an AWS CodeCommit repository, see Set up AWS CodeCommit for SSH Connections in the AWS CodeCommit User Guide.

For more information about working with server certificates, including a list of AWS services that can use the server certificates that you manage with IAM, go to Working with Server Certificates in the IAM User Guide.

If the UserName field is not specified, the UserName is determined implicitly based on the AWS access key ID used to sign the request. Because this action works for access keys under the AWS account, you can use this action to manage root credentials even if the AWS account has no associated users.

Updates the name and/or the path of the specified User.

IMPORTANT: You should understand the implications of changing a User's path or name. For more information, see Renaming Users and Groups in Using AWS Identity and Access Management.

NOTE:To change a User name the requester must have appropriate permissions on both the source object and the target object. For example, to change Bob to Robert, the entity making the request must have permission on Bob and Robert, or must have permission on all (*). For more information about permissions, see Permissions and Policies.

The SSH public key uploaded by this action can be used only for authenticating the associated IAM user to an AWS CodeCommit repository. For more information about using SSH keys to authenticate to an AWS CodeCommit repository, see Set up AWS CodeCommit for SSH Connections in the AWS CodeCommit User Guide.

Uploads a server certificate entity for the AWS account. The server certificate entity includes a public key certificate, a private key, and an optional certificate chain, which should all be PEM-encoded.

For information about the number of server certificates you can upload, see Limitations on IAM Entities in Using AWS Identity and Access Management .

NOTE:Because the body of the public key certificate, private key, and the certificate chain can be large, you should use POST rather than GET when calling UploadServerCertificate. For information about setting up signatures and authorization through the API, go to Signing AWS API Requests in the AWS General Reference. For general information about using the Query API with IAM, go to Making Query Requests in Using IAM.

Contains the result of a successful invocation of the UploadServerCertificate action.

Uploads an X.509 signing certificate and associates it with the specified User. Some AWS services use X.509 signing certificates to validate requests that are signed with a corresponding private key. When you upload the certificate, its default status is Active .

If the UserName field is not specified, the User name is determined implicitly based on the AWS Access Key ID used to sign the request. Because this action works for access keys under the AWS Account, this API can be used to manage root credentials even if the AWS Account has no associated Users.

NOTE:Because the body of a X.509 certificate can be large, you should use POST rather than GET when calling UploadSigningCertificate. For more information, see Using the Query API in Using AWS Identity and Access Management.

The User data type contains information about a User.

This data type is used as a response element in the following actions:

• CreateUser

• GetUser

• ListUsers