AWS IAM integration

Overview

AWS IAM (Identity and Access Management) controls authentication and authorisation across AWS services. The Automize AWS IAM connector covers users, groups, roles, policies, access keys, and policy attachment/detachment.

• Regions: IAM is global (not regional). All API calls go through us-east-1 endpoint regardless of where your resources live.
• Plans: Free. IAM is included with all AWS accounts.

Setting up the connection

Auth type: aws_sigv4.

1. AWS Console → IAM → user with programmatic access (be careful – IAM access is highly privileged).
2. Attach IAMFullAccess (or scoped subset – many ops need iam:Create/Delete/Attach permissions).
3. In Automize, open Settings → Connectors → AWS IAM → Add connection. Paste keys (region used for SigV4 signing, doesn't matter functionally since IAM is global).

Find your credentials at https://us-east-1.console.aws.amazon.com/iam/home.

Rate limits

Per-account API limits – generous for routine usage but throttles on bulk migrations (1000s of users). Connector retries Throttling errors.

Data model

IAM principals + policies:

    Users (long-term human/service identities) ─── Access Keys ─── Groups
    Roles (assumable identities – for cross-account, EC2, Lambda)
    Policies ─── attached to Users, Groups, or Roles
    Permissions Boundary, SCPs (Org-level) – separate, not covered here

Available operations

22 operations available. Click any row to jump to its detail.

Operations

Add User to Group

Add a user to a group

No input parameters.

Tips

• UserName + GroupName.

Attach Role Policy

Attach a policy to a role

No input parameters.

Tips

• RoleName + PolicyArn. Same shape as user attachment.

Attach User Policy

Attach a policy to a user

No input parameters.

Tips

• UserName + PolicyArn. Max 10 policies per user. Prefer attaching to Groups.

Create Access Key

Create an access key for a user

No input parameters.

Tips

• UserName. Returns AccessKeyId + SecretAccessKey – secret only shown once. Store it now.
• Max 2 active keys per user (rotate by creating a new one + deactivating the old).

Create Group

Create an IAM group

No input parameters.

Tips

• GroupName + Path. Empty group – add users via Add User To Group.

Create Role

Create an IAM role

No input parameters.

Tips

• RoleName + AssumeRolePolicyDocument (trust policy, JSON).
• Add permissions via Attach Role Policy after creation.

Create User

Create a new IAM user

No input parameters.

Tips

• UserName + optional Path + Tags.
• Doesn't create access keys – separate call. Doesn't enable console – needs login profile.

Delete Access Key

Delete an access key

No input parameters.

Tips

• UserName + AccessKeyId. Permanent. Use Deactivate (separate, not exposed here) for reversible suspension.

Delete Group

Delete an IAM group

No input parameters.

Tips

• Must be empty (no users + no attached policies).

Delete Role

Delete an IAM role

No input parameters.

Tips

• Must have no attached policies. Detach all first.

Delete User

Delete an IAM user

No input parameters.

Tips

• User must have no attached policies, group memberships, access keys, or login profile.
• Generally: delete access keys + detach policies + remove from groups + delete login profile, THEN delete user.

Detach Role Policy

Detach a policy from a role

No input parameters.

Tips

• Reverse of Attach Role Policy.

Detach User Policy

Detach a policy from a user

No input parameters.

Tips

• Reverse of Attach. Doesn't delete the policy – just unlinks.

Get Policy

Get IAM policy details

No input parameters.

Tips

• PolicyArn. Returns policy metadata. Get Policy Version (not exposed) for the actual statements.

Get Role

Get IAM role details

No input parameters.

Tips

• RoleName. Returns AssumeRolePolicyDocument (who can assume) + tags.

Get User

Get IAM user details

No input parameters.

Tips

• UserName. Returns user + creation date + last activity.

List Access Keys

List access keys for a user

No input parameters.

Tips

• UserName. Returns access key IDs (NOT secrets) + status (Active/Inactive) + creation date.

List Groups

List IAM groups

No input parameters.

Tips

• Pages 100 per call.

List Policies

List IAM policies

No input parameters.

Tips

• Filter by Scope (Local/AWS/All) – Local = customer-managed, AWS = AWS-managed.

List Roles

List IAM roles

No input parameters.

Tips

• Pages 100 per call. Filter by PathPrefix.

List Users

List IAM users

No input parameters.

Tips

• Filter by PathPrefix to scope. Pages 100 per call.

Remove User from Group

Remove a user from a group

No input parameters.

Tips

• UserName + GroupName.

FAQ

Why does Delete User fail?

User has lingering resources. Walk the cleanup: 1) Delete access keys, 2) Delete login profile, 3) Detach policies, 4) Remove from groups, 5) THEN delete user.

Inline policies vs managed policies?

Managed = standalone (can attach to many). Inline = embedded in a single user/role/group, deleted when the principal is. This connector exposes managed only – inline needs the PutUserPolicy / PutRolePolicy APIs (not yet exposed).

Access key rotation – how?

Create new key → update app to use new → wait → deactivate old → confirm app working → delete old. Never just delete + recreate (causes downtime).

Service-Linked Roles?

SLRs are AWS-managed roles created automatically when you use certain services. Can be deleted but it requires the service to release them first.

Related connectors

• Okta
• Aws-secrets-manager
• Aws-lambda
• Microsoft-graph