Overcast is alpha — behaviour and APIs may change between releases. Pin your version and read the changelog before upgrading.

overcast

IAM operations

Every IAM operation Overcast declares — 74 of 74 implemented — with status, behaviour notes and a link to the AWS API reference for each.

All 74 listed operations are implemented. Back to IAM.

Summary

Category✅ Supported⚠️ Partial
Users5
Access keys3
User inline policies4
User managed policies3
Permissions boundaries4
User tagging3
Roles7
Role inline policies4
Role managed policies3
Role tagging3
Managed policy tagging3
Instance profile tagging3
Instance profiles7
Managed policies41
Groups7
Group inline policies4
Group managed policies3
Policy simulation2
Account details1

Endpoints

Users

OperationStatusNotesAWS Docs
CreateUser✅ SupportedInline Tags applied at creation and returned on the resourcedocs
GetUser✅ SupportedReturns the resource’s Tagsdocs
ListUsers✅ SupportedReturns AWS’s listing subset: no Tags and no PermissionsBoundary — call GetUser for thosedocs
UpdateUser✅ Supporteddocs
DeleteUser✅ SupportedDeleteConflict (409) while access keys, inline or attached policies, or group memberships remaindocs

Access keys

OperationStatusNotesAWS Docs
CreateAccessKey✅ SupportedGenerates AKIA-prefixed key + secretdocs
ListAccessKeys✅ Supporteddocs
DeleteAccessKey✅ Supporteddocs

User inline policies

OperationStatusNotesAWS Docs
PutUserPolicy✅ SupportedRejects a malformed document with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs
GetUserPolicy✅ Supporteddocs
DeleteUserPolicy✅ Supporteddocs
ListUserPolicies✅ Supporteddocs

User managed policies

OperationStatusNotesAWS Docs
AttachUserPolicy✅ Supporteddocs
DetachUserPolicy✅ Supporteddocs
ListAttachedUserPolicies✅ Supporteddocs

Permissions boundaries

OperationStatusNotesAWS Docs
PutUserPermissionsBoundary✅ SupportedApplied by SimulatePrincipalPolicy and by opt-in enforcement; NoSuchEntity if the policy does not existdocs
DeleteUserPermissionsBoundary✅ Supporteddocs
PutRolePermissionsBoundary✅ SupportedApplied by SimulatePrincipalPolicy and by opt-in enforcement; NoSuchEntity if the policy does not existdocs
DeleteRolePermissionsBoundary✅ Supporteddocs

User tagging

OperationStatusNotesAWS Docs
TagUser✅ Supporteddocs
UntagUser✅ Supporteddocs
ListUserTags✅ Supporteddocs

Roles

OperationStatusNotesAWS Docs
CreateRole✅ SupportedInline Tags applied at creation and returned on the role; the AssumeRolePolicyDocument is parsed, and a malformed one rejected with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs
GetRole✅ SupportedReturns the resource’s Tagsdocs
ListRoles✅ SupportedReturns AWS’s listing subset: no Tags and no PermissionsBoundary — call GetRole for thosedocs
DeleteRole✅ SupportedDeleteConflict (409) while an instance profile association or inline/attached policies remaindocs
UpdateRole✅ SupportedAn empty Description clears it; an omitted one is left unchangeddocs
UpdateAssumeRolePolicy✅ SupportedRejects a malformed document with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs
CreateServiceLinkedRole✅ Supporteddocs

Role inline policies

OperationStatusNotesAWS Docs
PutRolePolicy✅ SupportedRejects a malformed document with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs
GetRolePolicy✅ Supporteddocs
ListRolePolicies✅ Supporteddocs
DeleteRolePolicy✅ Supporteddocs

Role managed policies

OperationStatusNotesAWS Docs
AttachRolePolicy✅ Supporteddocs
DetachRolePolicy✅ Supporteddocs
ListAttachedRolePolicies✅ Supporteddocs

Role tagging

OperationStatusNotesAWS Docs
TagRole✅ Supporteddocs
UntagRole✅ Supporteddocs
ListRoleTags✅ Supporteddocs

Managed policy tagging

OperationStatusNotesAWS Docs
TagPolicy✅ Supporteddocs
UntagPolicy✅ Supporteddocs
ListPolicyTags✅ Supporteddocs

Instance profile tagging

OperationStatusNotesAWS Docs
TagInstanceProfile✅ Supporteddocs
UntagInstanceProfile✅ Supporteddocs
ListInstanceProfileTags✅ Supporteddocs

Instance profiles

OperationStatusNotesAWS Docs
CreateInstanceProfile✅ SupportedInline Tags applied at creation and returned on the resourcedocs
GetInstanceProfile✅ SupportedReturns the resource’s Tagsdocs
DeleteInstanceProfile✅ Supporteddocs
AddRoleToInstanceProfile✅ Supporteddocs
RemoveRoleFromInstanceProfile✅ Supporteddocs
ListInstanceProfiles✅ SupportedReturns AWS’s listing subset: no Tags — call the matching Get for thosedocs
ListInstanceProfilesForRole✅ Supporteddocs

Managed policies

OperationStatusNotesAWS Docs
CreatePolicy✅ SupportedInline Tags applied at creation and returned on the policy. The PolicyDocument is parsed before it is stored and a malformed one is rejected with MalformedPolicyDocument (400): it must be valid JSON, a JSON object, carry a Statement that is an object or a non-empty array, and give every statement an Effect of exactly Allow or Deny plus an Action or NotAction (not both) — with Resource/NotResource mutually exclusive too, and Version, when present, one of 2012-10-17 or 2008-10-17. Deliberately not checked: ARN syntax in Resource/Principal, whether an action name exists, condition-operator and condition-key names, Sid uniqueness and character set, Principal appearing in an identity policy or being absent from a trust policy, Resource being absent where AWS requires it, the 6,144-character document size limit, and an omitted or empty document, which is left to the operation’s own required-parameter handling rather than reported as malformeddocs
GetPolicy✅ SupportedReturns the policy’s Tags. AttachmentCount and PermissionsBoundaryUsageCount are derived from the users, groups and roles that refer to the policy, so they follow attach/detach and boundary changes; IsAttachable is always true, as every policy here is a customer managed onedocs
ListPolicies✅ SupportedReturns AWS’s listing subset: no Tags and no Description — call GetPolicy for those. Carries the same derived AttachmentCount and PermissionsBoundaryUsageCount as GetPolicydocs
DeletePolicy✅ SupportedDeleteConflict (409) while the policy is attached to any user, role or group, or used as one of their permissions boundariesdocs
CreatePolicyVersion⚠️ PartialSetAsDefault=true replaces the operative document and bumps DefaultVersionId; superseded versions are not retained and cannot be read back. Rejects a malformed document with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs

Groups

OperationStatusNotesAWS Docs
CreateGroup✅ Supporteddocs
GetGroup✅ SupportedReturns the group’s members, paginated with Marker/MaxItems (default 100, max 1000)docs
DeleteGroup✅ SupportedDeleteConflict (409) while members or inline/attached policies remaindocs
ListGroups✅ Supporteddocs
AddUserToGroup✅ Supporteddocs
RemoveUserFromGroup✅ Supporteddocs
ListGroupsForUser✅ Supporteddocs

Group inline policies

OperationStatusNotesAWS Docs
PutGroupPolicy✅ SupportedRejects a malformed document with MalformedPolicyDocument (400) — see CreatePolicy for what that check does and does not coverdocs
GetGroupPolicy✅ Supporteddocs
DeleteGroupPolicy✅ Supporteddocs
ListGroupPolicies✅ Supporteddocs

Group managed policies

OperationStatusNotesAWS Docs
AttachGroupPolicy✅ Supporteddocs
DetachGroupPolicy✅ Supporteddocs
ListAttachedGroupPolicies✅ Supporteddocs

Policy simulation

OperationStatusNotesAWS Docs
SimulatePrincipalPolicy✅ SupportedReal evaluation of the principal’s identity policies (plus an optional ResourcePolicy and permissions boundary): allowed / explicitDeny / implicitDeny with MatchedStatements and MissingContextValuesdocs
SimulateCustomPolicy✅ SupportedEvaluates the supplied PolicyInputList without touching any stored entitydocs

Account details

OperationStatusNotesAWS Docs
GetAccountAuthorizationDetails✅ SupportedReturns all users, groups, roles, and managed policies in one calldocs