salt.modules.boto_iam

Connection module for Amazon IAM

configuration

This module accepts explicit iam credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More Information available at:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

If IAM roles are not used you need to specify them either in a pillar or in the minion's config file:

iam.keyid: GKTADJGHEIQSXMKKRBJ08H
iam.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
iam.region: us-east-1

It's also possible to specify key, keyid and region via a profile, either as a passed in dict, or as a string to pull from pillars or minion config:

myprofile:
    keyid: GKTADJGHEIQSXMKKRBJ08H
    key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
    region: us-east-1

depends

boto

salt.modules.boto_iam.add_user_to_group(user_name, group_name, region=None, key=None, keyid=None, profile=None)

Add user to group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.add_user_to_group myuser mygroup

salt.modules.boto_iam.associate_profile_to_role(profile_name, role_name, region=None, key=None, keyid=None, profile=None)

Associate an instance profile with an IAM role.

CLI Example:

salt myminion boto_iam.associate_profile_to_role myirole myiprofile

salt.modules.boto_iam.attach_group_policy(policy_name, group_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a group.

CLI Example:

salt myminion boto_iam.attach_group_policy mypolicy mygroup

salt.modules.boto_iam.attach_role_policy(policy_name, role_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a role.

CLI Example:

salt myminion boto_iam.attach_role_policy mypolicy myrole

salt.modules.boto_iam.attach_user_policy(policy_name, user_name, region=None, key=None, keyid=None, profile=None)

Attach a managed policy to a user.

CLI Example:

salt myminion boto_iam.attach_user_policy mypolicy myuser

salt.modules.boto_iam.build_policy(region=None, key=None, keyid=None, profile=None)

Build a default assume role policy.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.build_policy

salt.modules.boto_iam.create_access_key(user_name, region=None, key=None, keyid=None, profile=None)

Create access key id for a user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.create_access_key myuser

salt.modules.boto_iam.create_group(group_name, path=None, region=None, key=None, keyid=None, profile=None)

Create a group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.create_group group

salt.modules.boto_iam.create_instance_profile(name, region=None, key=None, keyid=None, profile=None)

Create an instance profile.

CLI Example:

salt myminion boto_iam.create_instance_profile myiprofile

salt.modules.boto_iam.create_login_profile(user_name, password, region=None, key=None, keyid=None, profile=None)

Creates a login profile for the specified user, give the user the ability to access AWS services and the AWS Management Console.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.create_login_profile user_name password

salt.modules.boto_iam.create_policy(policy_name, policy_document, path=None, description=None, region=None, key=None, keyid=None, profile=None)

Create a policy.

CLI Example:

salt myminios boto_iam.create_policy mypolicy '{"Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:Get*", "s3:List*"], "Resource": ["arn:aws:s3:::my-bucket/shared/*"]},]}'

salt.modules.boto_iam.create_policy_version(policy_name, policy_document, set_as_default=None, region=None, key=None, keyid=None, profile=None)

Create a policy version.

CLI Example:

salt myminios boto_iam.create_policy_version mypolicy '{"Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:Get*", "s3:List*"], "Resource": ["arn:aws:s3:::my-bucket/shared/*"]},]}'

salt.modules.boto_iam.create_role(name, policy_document=None, path=None, region=None, key=None, keyid=None, profile=None)

Create an instance role.

CLI Example:

salt myminion boto_iam.create_role myrole

salt.modules.boto_iam.create_role_policy(role_name, policy_name, policy, region=None, key=None, keyid=None, profile=None)

Create or modify a role policy.

CLI Example:

salt myminion boto_iam.create_role_policy myirole mypolicy '{"MyPolicy": "Statement": [{"Action": ["sqs:*"], "Effect": "Allow", "Resource": ["arn:aws:sqs:*:*:*"], "Sid": "MyPolicySqs1"}]}'

salt.modules.boto_iam.create_saml_provider(name, saml_metadata_document, region=None, key=None, keyid=None, profile=None)

Create SAML provider

CLI Example:

salt myminion boto_iam.create_saml_provider my_saml_provider_name saml_metadata_document

salt.modules.boto_iam.create_user(user_name, path=None, region=None, key=None, keyid=None, profile=None)

Create a user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.create_user myuser

salt.modules.boto_iam.deactivate_mfa_device(user_name, serial, region=None, key=None, keyid=None, profile=None)

Deactivates the specified MFA device and removes it from association with the user.

New in version 2016.3.0.

CLI Example:

salt myminion boto_iam.deactivate_mfa_device user_name serial_num

salt.modules.boto_iam.delete_access_key(access_key_id, user_name=None, region=None, key=None, keyid=None, profile=None)

Delete access key id from a user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.delete_access_key myuser

salt.modules.boto_iam.delete_group(group_name, region=None, key=None, keyid=None, profile=None)

Delete a group policy.

CLI Example:

salt myminion boto_iam.delete_group mygroup

salt.modules.boto_iam.delete_group_policy(group_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete a group policy.

CLI Example:

salt myminion boto_iam.delete_group_policy mygroup mypolicy

salt.modules.boto_iam.delete_instance_profile(name, region=None, key=None, keyid=None, profile=None)

Delete an instance profile.

CLI Example:

salt myminion boto_iam.delete_instance_profile myiprofile

salt.modules.boto_iam.delete_login_profile(user_name, region=None, key=None, keyid=None, profile=None)

Deletes a login profile for the specified user.

New in version 2016.3.0.

CLI Example:

salt myminion boto_iam.delete_login_profile user_name

salt.modules.boto_iam.delete_policy(policy_name, region=None, key=None, keyid=None, profile=None)

Delete a policy.

CLI Example:

salt myminion boto_iam.delete_policy mypolicy

salt.modules.boto_iam.delete_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Delete a policy version.

CLI Example:

salt myminion boto_iam.delete_policy_version mypolicy v1

salt.modules.boto_iam.delete_role(name, region=None, key=None, keyid=None, profile=None)

Delete an IAM role.

CLI Example:

salt myminion boto_iam.delete_role myirole

salt.modules.boto_iam.delete_role_policy(role_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete a role policy.

CLI Example:

salt myminion boto_iam.delete_role_policy myirole mypolicy

salt.modules.boto_iam.delete_saml_provider(name, region=None, key=None, keyid=None, profile=None)

Delete SAML provider

CLI Example:

salt myminion boto_iam.delete_saml_provider my_saml_provider_name

salt.modules.boto_iam.delete_server_cert(cert_name, region=None, key=None, keyid=None, profile=None)

Deletes a certificate from Amazon.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.delete_server_cert mycert_name

salt.modules.boto_iam.delete_user(user_name, region=None, key=None, keyid=None, profile=None)

Delete a user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.delete_user myuser

salt.modules.boto_iam.delete_user_policy(user_name, policy_name, region=None, key=None, keyid=None, profile=None)

Delete a user policy.

CLI Example:

salt myminion boto_iam.delete_user_policy myuser mypolicy

salt.modules.boto_iam.delete_virtual_mfa_device(serial, region=None, key=None, keyid=None, profile=None)

Deletes the specified virtual MFA device.

CLI Example:

salt myminion boto_iam.delete_virtual_mfa_device serial_num

salt.modules.boto_iam.describe_role(name, region=None, key=None, keyid=None, profile=None)

Get information for a role.

CLI Example:

salt myminion boto_iam.describe_role myirole

salt.modules.boto_iam.detach_group_policy(policy_name, group_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy to a group.

CLI Example:

salt myminion boto_iam.detach_group_policy mypolicy mygroup

salt.modules.boto_iam.detach_role_policy(policy_name, role_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy to a role.

CLI Example:

salt myminion boto_iam.detach_role_policy mypolicy myrole

salt.modules.boto_iam.detach_user_policy(policy_name, user_name, region=None, key=None, keyid=None, profile=None)

Detach a managed policy to a user.

CLI Example:

salt myminion boto_iam.detach_user_policy mypolicy myuser

salt.modules.boto_iam.disassociate_profile_from_role(profile_name, role_name, region=None, key=None, keyid=None, profile=None)

Disassociate an instance profile from an IAM role.

CLI Example:

salt myminion boto_iam.disassociate_profile_from_role myirole myiprofile

salt.modules.boto_iam.export_roles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get all IAM role details. Produces results that can be used to create an sls file.

CLI Example:

salt-call boto_iam.export_roles --out=txt | sed "s/local: //" > iam_roles.sls

salt.modules.boto_iam.export_users(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get all IAM user details. Produces results that can be used to create an sls file.

New in version 2016.3.0.

CLI Example:

salt-call boto_iam.export_users --out=txt | sed "s/local: //" > iam_users.sls

salt.modules.boto_iam.get_account_id(region=None, key=None, keyid=None, profile=None)

Get a the AWS account id associated with the used credentials.

CLI Example:

salt myminion boto_iam.get_account_id

salt.modules.boto_iam.get_account_policy(region=None, key=None, keyid=None, profile=None)

Get account policy for the AWS account.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_account_policy

salt.modules.boto_iam.get_all_access_keys(user_name, marker=None, max_items=None, region=None, key=None, keyid=None, profile=None)

Get all access keys from a user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_all_access_keys myuser

salt.modules.boto_iam.get_all_group_policies(group_name, region=None, key=None, keyid=None, profile=None)

Get a list of policy names from a group.

CLI Example:

salt myminion boto_iam.get_all_group_policies mygroup

salt.modules.boto_iam.get_all_groups(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM group details, starting at the optional path.

New in version 2016.3.0.

CLI Example:

salt-call boto_iam.get_all_groups

salt.modules.boto_iam.get_all_instance_profiles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM instance profiles, starting at the optional path.

New in version 2016.11.0.

CLI Example:

salt-call boto_iam.get_all_instance_profiles

salt.modules.boto_iam.get_all_mfa_devices(user_name, region=None, key=None, keyid=None, profile=None)

Get all MFA devices associated with an IAM user.

New in version 2016.3.0.

CLI Example:

salt myminion boto_iam.get_all_mfa_devices user_name

salt.modules.boto_iam.get_all_roles(path_prefix=None, region=None, key=None, keyid=None, profile=None)

Get and return all IAM role details, starting at the optional path.

New in version 2016.3.0.

CLI Example:

salt-call boto_iam.get_all_roles

salt.modules.boto_iam.get_all_user_policies(user_name, marker=None, max_items=None, region=None, key=None, keyid=None, profile=None)

Get all user policies.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_all_user_policies myuser

salt.modules.boto_iam.get_all_users(path_prefix='/', region=None, key=None, keyid=None, profile=None)

Get and return all IAM user details, starting at the optional path.

New in version 2016.3.0.

CLI Example:

salt-call boto_iam.get_all_users

salt.modules.boto_iam.get_group(group_name, region=None, key=None, keyid=None, profile=None)

Get group information.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_group mygroup

salt.modules.boto_iam.get_group_members(group_name, region=None, key=None, keyid=None, profile=None)

Get group information.

New in version 2016.3.0.

CLI Example:

salt myminion boto_iam.get_group mygroup

salt.modules.boto_iam.get_group_policy(group_name, policy_name, region=None, key=None, keyid=None, profile=None)

Retrieves the specified policy document for the specified group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_group_policy mygroup policyname

salt.modules.boto_iam.get_policy(policy_name, region=None, key=None, keyid=None, profile=None)

Check to see if policy exists.

CLI Example:

salt myminion boto_iam.instance_profile_exists myiprofile

salt.modules.boto_iam.get_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Check to see if policy exists.

CLI Example:

salt myminion boto_iam.instance_profile_exists myiprofile

salt.modules.boto_iam.get_role_policy(role_name, policy_name, region=None, key=None, keyid=None, profile=None)

Get a role policy.

CLI Example:

salt myminion boto_iam.get_role_policy myirole mypolicy

salt.modules.boto_iam.get_saml_provider(name, region=None, key=None, keyid=None, profile=None)

Get SAML provider document.

CLI Example:

salt myminion boto_iam.get_saml_provider arn

salt.modules.boto_iam.get_saml_provider_arn(name, region=None, key=None, keyid=None, profile=None)

Get SAML provider

CLI Example:

salt myminion boto_iam.get_saml_provider_arn my_saml_provider_name

salt.modules.boto_iam.get_server_certificate(cert_name, region=None, key=None, keyid=None, profile=None)

Returns certificate information from Amazon

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_server_certificate mycert_name

salt.modules.boto_iam.get_user(user_name=None, region=None, key=None, keyid=None, profile=None)

Get user information.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_user myuser

salt.modules.boto_iam.get_user_policy(user_name, policy_name, region=None, key=None, keyid=None, profile=None)

Retrieves the specified policy document for the specified user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.get_user_policy myuser mypolicyname

salt.modules.boto_iam.instance_profile_exists(name, region=None, key=None, keyid=None, profile=None)

Check to see if an instance profile exists.

CLI Example:

salt myminion boto_iam.instance_profile_exists myiprofile

salt.modules.boto_iam.list_attached_group_policies(group_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List entities attached to the given group.

CLI Example:

salt myminion boto_iam.list_entities_for_policy mypolicy

salt.modules.boto_iam.list_attached_role_policies(role_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List entities attached to the given role.

CLI Example:

salt myminion boto_iam.list_entities_for_policy mypolicy

salt.modules.boto_iam.list_attached_user_policies(user_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List entities attached to the given user.

CLI Example:

salt myminion boto_iam.list_entities_for_policy mypolicy

salt.modules.boto_iam.list_entities_for_policy(policy_name, path_prefix=None, entity_filter=None, region=None, key=None, keyid=None, profile=None)

List entities that a policy is attached to.

CLI Example:

salt myminion boto_iam.list_entities_for_policy mypolicy

salt.modules.boto_iam.list_instance_profiles(path_prefix='/', region=None, key=None, keyid=None, profile=None)

List all IAM instance profiles, starting at the optional path.

New in version 2016.11.0.

CLI Example:

salt-call boto_iam.list_instance_profiles

salt.modules.boto_iam.list_policies(region=None, key=None, keyid=None, profile=None)

List policies.

CLI Example:

salt myminion boto_iam.list_policies

salt.modules.boto_iam.list_policy_versions(policy_name, region=None, key=None, keyid=None, profile=None)

List versions of a policy.

CLI Example:

salt myminion boto_iam.list_policy_versions mypolicy

salt.modules.boto_iam.list_role_policies(role_name, region=None, key=None, keyid=None, profile=None)

Get a list of policy names from a role.

CLI Example:

salt myminion boto_iam.list_role_policies myirole

salt.modules.boto_iam.list_saml_providers(region=None, key=None, keyid=None, profile=None)

List SAML providers.

CLI Example:

salt myminion boto_iam.list_saml_providers

salt.modules.boto_iam.policy_exists(policy_name, region=None, key=None, keyid=None, profile=None)

Check to see if policy exists.

CLI Example:

salt myminion boto_iam.instance_profile_exists myiprofile

salt.modules.boto_iam.policy_version_exists(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Check to see if policy exists.

CLI Example:

salt myminion boto_iam.instance_profile_exists myiprofile

salt.modules.boto_iam.profile_associated(role_name, profile_name, region, key, keyid, profile)

Check to see if an instance profile is associated with an IAM role.

CLI Example:

salt myminion boto_iam.profile_associated myirole myiprofile

salt.modules.boto_iam.put_group_policy(group_name, policy_name, policy_json, region=None, key=None, keyid=None, profile=None)

Adds or updates the specified policy document for the specified group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.put_group_policy mygroup policyname policyrules

salt.modules.boto_iam.put_user_policy(user_name, policy_name, policy_json, region=None, key=None, keyid=None, profile=None)

Adds or updates the specified policy document for the specified user.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.put_user_policy myuser policyname policyrules

salt.modules.boto_iam.remove_user_from_group(group_name, user_name, region=None, key=None, keyid=None, profile=None)

Remove user from group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.remove_user_from_group mygroup myuser

salt.modules.boto_iam.role_exists(name, region=None, key=None, keyid=None, profile=None)

Check to see if an IAM role exists.

CLI Example:

salt myminion boto_iam.role_exists myirole

salt.modules.boto_iam.set_default_policy_version(policy_name, version_id, region=None, key=None, keyid=None, profile=None)

Set the default version of a policy.

CLI Example:

salt myminion boto_iam.set_default_policy_version mypolicy v1

salt.modules.boto_iam.update_account_password_policy(allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, region=None, key=None, keyid=None, profile=None)

Update the password policy for the AWS account.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.update_account_password_policy True

salt.modules.boto_iam.update_assume_role_policy(role_name, policy_document, region=None, key=None, keyid=None, profile=None)

Update an assume role policy for a role.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.update_assume_role_policy myrole '{"Statement":"..."}'

salt.modules.boto_iam.update_saml_provider(name, saml_metadata_document, region=None, key=None, keyid=None, profile=None)

Update SAML provider.

CLI Example:

salt myminion boto_iam.update_saml_provider my_saml_provider_name saml_metadata_document

salt.modules.boto_iam.upload_server_cert(cert_name, cert_body, private_key, cert_chain=None, path=None, region=None, key=None, keyid=None, profile=None)

Upload a certificate to Amazon.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.upload_server_cert mycert_name crt priv_key

Parameters

• cert_name -- The name for the server certificate. Do not include the path in this value.

• cert_body -- The contents of the public key certificate in PEM-encoded format.

• private_key -- The contents of the private key in PEM-encoded format.

• cert_chain -- The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.

• path -- The path for the server certificate.

• region -- The name of the region to connect to.

• key -- The key to be used in order to connect

• keyid -- The keyid to be used in order to connect

• profile -- The profile that contains a dict of region, key, keyid

Returns

True / False

salt.modules.boto_iam.user_exists_in_group(user_name, group_name, region=None, key=None, keyid=None, profile=None)

Check if user exists in group.

New in version 2015.8.0.

CLI Example:

salt myminion boto_iam.user_exists_in_group myuser mygroup