# IAM compatibility, v0.0.1-alpha.44 > Compatibility test results for IAM in Overcast v0.0.1-alpha.44. 159 tests. Of the 1053 results that measure Overcast, 780 pass (74%). 41 tests have a result Overcast has to act on, listed below with the evidence. The overview, with every service, is at https://overcast.sh/compat/index.md. ## Tests Overcast does not yet pass ### DeletePolicyVersion Group `iam-gen-policy`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetAccessKeyLastUsed Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetAccountPasswordPolicy Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetAccountSummary Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetContextKeysForCustomPolicy Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetContextKeysForPrincipalPolicy Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetCredentialReport Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetDelegationRequest Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetHumanReadableSummary Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetLoginProfile Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetMFADevice Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetOpenIDConnectProvider Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetOrganizationsAccessReport Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetOutboundWebIdentityFederationInfo Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetPolicyVersion Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetSAMLProvider Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetSSHPublicKey Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetServerCertificate Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetServiceLastAccessedDetails Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetServiceLastAccessedDetailsWithEntities Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### GetServiceLinkedRoleDeletionStatus Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListAccountAliases Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListDelegationRequests Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListEntitiesForPolicy Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListMFADeviceTags Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListMFADevices Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListOpenIDConnectProviderTags Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListOpenIDConnectProviders Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListOrganizationsFeatures Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListPoliciesGrantingServiceAccess Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListPolicyVersions Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListSAMLProviderTags Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListSAMLProviders Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListSSHPublicKeys Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListServerCertificateTags Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListServerCertificates Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListServiceSpecificCredentials Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListSigningCertificates Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### ListVirtualMFADevices Group `iam-gen-probe`. - AWS CLI v2: Not emulated yet. - AWS SDK for .NET: Not emulated yet. - AWS SDK for Go v2: Not emulated yet. - AWS SDK for Java 2.x: Not emulated yet. - AWS SDK for JavaScript v3: Not emulated yet. - AWS SDK for Python (boto3): Not emulated yet. - AWS SDK for Rust: Not emulated yet. ### PutRolePermissionsBoundary Group `iam-gen-role`. - AWS CLI v2: New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for .NET: New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Go v2: New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Java 2.x: New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for JavaScript v3: New test, still soaking. readback at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Python (boto3): New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Rust: New test, still soaking. readback equals at `$.Role.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". ### PutUserPermissionsBoundary Group `iam-gen-user`. - AWS CLI v2: New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for .NET: New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Go v2: New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Java 2.x: New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for JavaScript v3: New test, still soaking. readback at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Python (boto3): New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". - AWS SDK for Rust: New test, still soaking. readback equals at `$.User.PermissionsBoundary.PermissionsBoundaryType`: expected "PermissionsBoundaryPolicy", actual "Policy". ## Not measured Results that say nothing about Overcast itself. - Test not written for this SDK, AWS SDK for Rust: 46 tests (CreateUser, GetUser, ListUsers, CreateAccessKey, DeleteAccessKey, PutUserPolicy, GetUserPolicy, DeleteUserPolicy, UpdateUser, ListAccessKeys, DeleteUser, CreateRole, CreateRoleMalformedDocument, GetRole, GetRoleReturnsTags, ListRoles, AttachRolePolicy, ListAttachedRolePolicies, DetachRolePolicy, CreateInstanceProfile, AddRoleToInstanceProfile, GetInstanceProfile, DeleteRole, PutRolePolicy, GetRolePolicy, ListRolePolicies, DeleteRolePolicy, CreatePolicy, CreatePolicyMalformedDocument, GetPolicy, GetPolicyReturnsTags, ListPolicies, GetPolicyAttachmentCountAfterAttach, GetPolicyAttachmentCountAfterDetach, DeletePolicy, CreateGroup, AddUserToGroup, ListGroupsForUser, RemoveUserFromGroup, GetGroup, DeleteGroup, SimulateCustomPolicyAllowed, SimulateCustomPolicyImplicitDeny, SimulateCustomPolicyExplicitDeny, SimulatePrincipalPolicyAllowed, SimulatePrincipalPolicyImplicitDeny) ## Not tested Operations with no test. The generator declined to write one, for the reason given. - AcceptDelegationRequest (`never-probe`): AcceptDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AcquireRole (`never-probe`): AcquireRole is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AddClientIDToOpenIDConnectProvider (`never-probe`): AddClientIDToOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - AssociateDelegationRequest (`never-probe`): AssociateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ChangePassword (`never-probe`): Changes the console password of the IAM user whose credentials signed the request, which locks that user out of the console until somebody with the new password says otherwise. - CreateAccountAlias (`never-probe`): Sets the account-wide sign-in alias. There is one per account, so the call silently replaces whatever the account already had, and every bookmarked sign-in URL for the old alias stops working. - CreateDelegationRequest (`never-probe`): CreateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateLoginProfile (`never-probe`): Gives an IAM user a console password. It turns a programmatic-only identity into one that can sign in to the console, which is a change to the account's attack surface rather than to a test fixture. - CreateOpenIDConnectProvider (`never-probe`): CreateOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateSAMLProvider (`never-probe`): Registers a SAML identity provider for the account. Everything the provider's assertions are trusted for follows from it, and nothing in a probe group removes it. - CreateServiceLinkedRole (`probe-of-implemented-op`): CreateServiceLinkedRole is implemented (Supported), so it may not be probed, and no recipe resource gives it a role - CreateServiceSpecificCredential (`never-probe`): CreateServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - CreateVirtualMFADevice (`never-probe`): Allocates a virtual MFA device with its own seed. AWS counts it against the account's device quota whether or not anybody ever enables it, and only DeleteVirtualMFADevice reclaims it. - DeactivateMFADevice (`never-probe`): Removes the MFA device from a user, so an identity that was protected by a second factor no longer is. - DeleteAccountAlias (`never-probe`): Removes the account's sign-in alias, breaking every sign-in URL built on it. - DeleteAccountPasswordPolicy (`never-probe`): Deletes the account-wide password policy, so every complexity, rotation and reuse rule the account relied on is gone at once and AWS keeps no copy to restore. - DeleteLoginProfile (`never-probe`): Removes an IAM user's console password, locking that user out of the console immediately. - DeleteOpenIDConnectProvider (`never-probe`): DeleteOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSAMLProvider (`never-probe`): DeleteSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSSHPublicKey (`never-probe`): DeleteSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteServerCertificate (`never-probe`): DeleteServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteServiceLinkedRole (`never-probe`): Starts the deletion of a service-linked role. The role is what an AWS service uses to act in the account, so deleting it stops that service working, and the deletion is asynchronous — the call returns a task id and cannot be taken back. - DeleteServiceSpecificCredential (`never-probe`): DeleteServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - DeleteSigningCertificate (`never-probe`): Deletes an X.509 signing certificate from a user. Anything signing requests with that certificate stops being able to authenticate. - DeleteVirtualMFADevice (`never-probe`): Deletes a virtual MFA device. AWS keeps no copy of its seed, so the device cannot be recreated and whoever enrolled it has to enrol again. - DisableOrganizationsRootCredentialsManagement (`never-probe`): Turns off centralised root-credentials management for the organization, returning root credentials to each member account. It is an organization-wide security posture change made from one API call. - DisableOrganizationsRootSessions (`never-probe`): Turns off privileged root sessions for the organization's member accounts, changing what the management account can do in every one of them. - DisableOutboundWebIdentityFederation (`never-probe`): Turns off the account's outbound web identity federation, so every external workload that was exchanging this account's identity for a token stops being able to. - EnableMFADevice (`never-probe`): Associates an MFA device with a user and requires two consecutive authentication codes to do it. A probe would either enrol a device nobody asked to enrol or spend the user's authentication attempts guessing codes. - EnableOrganizationsRootCredentialsManagement (`never-probe`): Turns on centralised root-credentials management across the organization, which takes root credentials away from every member account. - EnableOrganizationsRootSessions (`never-probe`): Turns on privileged root sessions across the organization's member accounts. - EnableOutboundWebIdentityFederation (`never-probe`): Turns on outbound web identity federation for the account, which starts vending tokens that name this account to external workloads. - GenerateCredentialReport (`never-probe`): Starts the account-wide credential report job. It is billed, it is rate limited to one report every four hours, and it collects every credential's age and last-used data into a report a probe has no reason to want. - GenerateOrganizationsAccessReport (`never-probe`): GenerateOrganizationsAccessReport is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GenerateServiceLastAccessedDetails (`never-probe`): GenerateServiceLastAccessedDetails is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - GetAccountProperties (`never-probe`): A read, and the one entry here that is not about danger. AWS added GetAccountProperties to the model after every SDK the typed suites pin: aws-sdk-go-v2/service/iam v1.53.7 declares no GetAccountPropertiesInput, so probing it scopes this whole probe group away from go-sdk with go-emit-unsupported, and the java, dotnet and rust emitters — which read the model rather than their SDK — would emit a call those builds cannot compile. It takes no required member, so withholding a curated literal, which is what leaves GetRoleTemplateVersion refused, cannot reach it and this map is the only lever. Delete the entry once the pins carry the operation. - GetRoleTemplateVersion (`unbound-required-member`): GetRoleTemplateVersion.TemplateArn (arnType, a string) has no bind, no matching export, no curated value and no derivable literal - PutAccountProperties (`never-probe`): Writes account-level IAM properties. There is one set per account, so a probe would overwrite the caller's own settings with no way to know what they were. - RejectDelegationRequest (`never-probe`): RejectDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - RemoveClientIDFromOpenIDConnectProvider (`never-probe`): RemoveClientIDFromOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ResetServiceSpecificCredential (`never-probe`): ResetServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - ResyncMFADevice (`never-probe`): Resynchronises a user's MFA device with two authentication codes, which consumes the user's codes and, on repeated failure, is what an attacker guessing them looks like. - SendDelegationToken (`never-probe`): SendDelegationToken is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - SetDefaultPolicyVersion (`never-probe`): Changes which version of a managed policy is the operative one. Every principal the policy is attached to gets a different effective permission set the moment the call lands. - SetSecurityTokenServicePreferences (`never-probe`): Sets the account-wide STS global endpoint token version, which decides whether tokens the account mints are usable in Regions enabled after the call. - TagMFADevice (`never-probe`): TagMFADevice is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagOpenIDConnectProvider (`never-probe`): TagOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagSAMLProvider (`never-probe`): TagSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - TagServerCertificate (`never-probe`): TagServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagMFADevice (`never-probe`): UntagMFADevice is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagOpenIDConnectProvider (`never-probe`): UntagOpenIDConnectProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagSAMLProvider (`never-probe`): UntagSAMLProvider is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UntagServerCertificate (`never-probe`): UntagServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateAccessKey (`never-probe`): Activates or deactivates an access key. Deactivating one an application is signing with breaks that application immediately, and a probe cannot know which keys are in use. - UpdateAccountPasswordPolicy (`never-probe`): Replaces the account-wide password policy wholesale. Unset members are reset to AWS's defaults rather than left alone, so a partial call silently relaxes rules the account depended on. - UpdateDelegationRequest (`never-probe`): UpdateDelegationRequest is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateGroup (`never-probe`): UpdateGroup is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateLoginProfile (`never-probe`): Sets a new console password for an IAM user, locking out whoever held the old one. - UpdateOpenIDConnectProviderThumbprint (`never-probe`): UpdateOpenIDConnectProviderThumbprint is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateRoleDescription (`never-probe`): UpdateRoleDescription is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateSAMLProvider (`never-probe`): Replaces the metadata document of a live SAML provider, which changes which assertions the account trusts. - UpdateSSHPublicKey (`never-probe`): UpdateSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServerCertificate (`never-probe`): UpdateServerCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateServiceSpecificCredential (`never-probe`): UpdateServiceSpecificCredential is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UpdateSigningCertificate (`never-probe`): UpdateSigningCertificate is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UploadSSHPublicKey (`never-probe`): UploadSSHPublicKey is not a read operation; probes call unimplemented operations against a live account and must be side-effect free - UploadServerCertificate (`never-probe`): Uploads a server certificate and its private key into the account's IAM certificate store. A probe has no key to upload that is not either a real one or a fake the account then holds forever. - UploadSigningCertificate (`never-probe`): Uploads an X.509 signing certificate for a user, adding a new way to authenticate as that identity.