# IAM operations All 74 listed operations are implemented. Back to [IAM](/docs/services/iam/index.md). ## Summary | Category | ✅ Supported | ⚠️ Partial | | --- | --- | --- | | Users | 5 | | | Access keys | 3 | | | User inline policies | 4 | | | User managed policies | 3 | | | Permissions boundaries | 4 | | | User tagging | 3 | | | Roles | 7 | | | Role inline policies | 4 | | | Role managed policies | 3 | | | Role tagging | 3 | | | Managed policy tagging | 3 | | | Instance profile tagging | 3 | | | Instance profiles | 7 | | | Managed policies | 4 | 1 | | Groups | 7 | | | Group inline policies | 4 | | | Group managed policies | 3 | | | Policy simulation | 2 | | | Account details | 1 | | --- ## Endpoints ### Users | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateUser` | ✅ Supported | Inline `Tags` applied at creation and returned on the resource | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html) | | `GetUser` | ✅ Supported | Returns the resource's `Tags` | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUser.html) | | `ListUsers` | ✅ Supported | Returns AWS's listing subset: no `Tags` and no `PermissionsBoundary` — call `GetUser` for those | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUsers.html) | | `UpdateUser` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateUser.html) | | `DeleteUser` | ✅ Supported | DeleteConflict (409) while access keys, inline or attached policies, or group memberships remain | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUser.html) | ### Access keys | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateAccessKey` | ✅ Supported | Generates AKIA-prefixed key + secret | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html) | | `ListAccessKeys` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html) | | `DeleteAccessKey` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccessKey.html) | ### User inline policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutUserPolicy` | ✅ Supported | Rejects a malformed document with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPolicy.html) | | `GetUserPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUserPolicy.html) | | `DeleteUserPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPolicy.html) | | `ListUserPolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserPolicies.html) | ### User managed policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AttachUserPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html) | | `DetachUserPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachUserPolicy.html) | | `ListAttachedUserPolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html) | ### Permissions boundaries | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutUserPermissionsBoundary` | ✅ Supported | Applied by SimulatePrincipalPolicy and by opt-in enforcement; NoSuchEntity if the policy does not exist | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPermissionsBoundary.html) | | `DeleteUserPermissionsBoundary` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPermissionsBoundary.html) | | `PutRolePermissionsBoundary` | ✅ Supported | Applied by SimulatePrincipalPolicy and by opt-in enforcement; NoSuchEntity if the policy does not exist | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePermissionsBoundary.html) | | `DeleteRolePermissionsBoundary` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePermissionsBoundary.html) | ### User tagging | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagUser` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagUser.html) | | `UntagUser` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagUser.html) | | `ListUserTags` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserTags.html) | ### Roles | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateRole` | ✅ Supported | Inline `Tags` applied at creation and returned on the role; the `AssumeRolePolicyDocument` is parsed, and a malformed one rejected with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html) | | `GetRole` | ✅ Supported | Returns the resource's `Tags` | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRole.html) | | `ListRoles` | ✅ Supported | Returns AWS's listing subset: no `Tags` and no `PermissionsBoundary` — call `GetRole` for those | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoles.html) | | `DeleteRole` | ✅ Supported | DeleteConflict (409) while an instance profile association or inline/attached policies remain | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRole.html) | | `UpdateRole` | ✅ Supported | An empty `Description` clears it; an omitted one is left unchanged | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateRole.html) | | `UpdateAssumeRolePolicy` | ✅ Supported | Rejects a malformed document with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html) | | `CreateServiceLinkedRole` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceLinkedRole.html) | ### Role inline policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutRolePolicy` | ✅ Supported | Rejects a malformed document with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html) | | `GetRolePolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRolePolicy.html) | | `ListRolePolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRolePolicies.html) | | `DeleteRolePolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePolicy.html) | ### Role managed policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AttachRolePolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html) | | `DetachRolePolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachRolePolicy.html) | | `ListAttachedRolePolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html) | ### Role tagging | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagRole` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagRole.html) | | `UntagRole` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagRole.html) | | `ListRoleTags` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoleTags.html) | ### Managed policy tagging | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagPolicy.html) | | `UntagPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagPolicy.html) | | `ListPolicyTags` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyTags.html) | ### Instance profile tagging | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagInstanceProfile` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagInstanceProfile.html) | | `UntagInstanceProfile` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagInstanceProfile.html) | | `ListInstanceProfileTags` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfileTags.html) | ### Instance profiles | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateInstanceProfile` | ✅ Supported | Inline `Tags` applied at creation and returned on the resource | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateInstanceProfile.html) | | `GetInstanceProfile` | ✅ Supported | Returns the resource's `Tags` | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetInstanceProfile.html) | | `DeleteInstanceProfile` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteInstanceProfile.html) | | `AddRoleToInstanceProfile` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddRoleToInstanceProfile.html) | | `RemoveRoleFromInstanceProfile` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveRoleFromInstanceProfile.html) | | `ListInstanceProfiles` | ✅ Supported | Returns AWS's listing subset: no `Tags` — call the matching `Get` for those | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfiles.html) | | `ListInstanceProfilesForRole` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfilesForRole.html) | ### Managed policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreatePolicy` | ✅ Supported | Inline `Tags` applied at creation and returned on the policy. The `PolicyDocument` is parsed before it is stored and a malformed one is rejected with `MalformedPolicyDocument` (400): it must be valid JSON, a JSON object, carry a `Statement` that is an object or a non-empty array, and give every statement an `Effect` of exactly `Allow` or `Deny` plus an `Action` or `NotAction` (not both) — with `Resource`/`NotResource` mutually exclusive too, and `Version`, when present, one of `2012-10-17` or `2008-10-17`. Deliberately **not** checked: ARN syntax in `Resource`/`Principal`, whether an action name exists, condition-operator and condition-key names, `Sid` uniqueness and character set, `Principal` appearing in an identity policy or being absent from a trust policy, `Resource` being absent where AWS requires it, the 6,144-character document size limit, and an omitted or empty document, which is left to the operation's own required-parameter handling rather than reported as malformed | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicy.html) | | `GetPolicy` | ✅ Supported | Returns the policy's `Tags`. `AttachmentCount` and `PermissionsBoundaryUsageCount` are derived from the users, groups and roles that refer to the policy, so they follow attach/detach and boundary changes; `IsAttachable` is always true, as every policy here is a customer managed one | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicy.html) | | `ListPolicies` | ✅ Supported | Returns AWS's listing subset: no `Tags` and no `Description` — call `GetPolicy` for those. Carries the same derived `AttachmentCount` and `PermissionsBoundaryUsageCount` as `GetPolicy` | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicies.html) | | `DeletePolicy` | ✅ Supported | DeleteConflict (409) while the policy is attached to any user, role or group, or used as one of their permissions boundaries | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html) | | `CreatePolicyVersion` | ⚠️ Partial | `SetAsDefault=true` replaces the operative document and bumps `DefaultVersionId`; superseded versions are not retained and cannot be read back. Rejects a malformed document with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html) | ### Groups | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateGroup` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateGroup.html) | | `GetGroup` | ✅ Supported | Returns the group's members, paginated with Marker/MaxItems (default 100, max 1000) | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroup.html) | | `DeleteGroup` | ✅ Supported | DeleteConflict (409) while members or inline/attached policies remain | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html) | | `ListGroups` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroups.html) | | `AddUserToGroup` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html) | | `RemoveUserFromGroup` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveUserFromGroup.html) | | `ListGroupsForUser` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupsForUser.html) | ### Group inline policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutGroupPolicy` | ✅ Supported | Rejects a malformed document with `MalformedPolicyDocument` (400) — see `CreatePolicy` for what that check does and does not cover | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutGroupPolicy.html) | | `GetGroupPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroupPolicy.html) | | `DeleteGroupPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroupPolicy.html) | | `ListGroupPolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupPolicies.html) | ### Group managed policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AttachGroupPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html) | | `DetachGroupPolicy` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachGroupPolicy.html) | | `ListAttachedGroupPolicies` | ✅ Supported | | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html) | ### Policy simulation | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `SimulatePrincipalPolicy` | ✅ Supported | Real evaluation of the principal's identity policies (plus an optional ResourcePolicy and permissions boundary): allowed / explicitDeny / implicitDeny with MatchedStatements and MissingContextValues | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html) | | `SimulateCustomPolicy` | ✅ Supported | Evaluates the supplied PolicyInputList without touching any stored entity | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulateCustomPolicy.html) | ### Account details | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `GetAccountAuthorizationDetails` | ✅ Supported | Returns all users, groups, roles, and managed policies in one call | [docs](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountAuthorizationDetails.html) | ## Related - [IAM](/docs/services/iam/index.md) — quick start, what works, and the differences from AWS - [All service pages](/docs/services/index.md)