Class: AWS::IAM
- Inherits:
-
Object
- Object
- AWS::IAM
- Defined in:
- lib/aws/iam.rb,
lib/aws/iam/user.rb,
lib/aws/iam/group.rb,
lib/aws/iam/client.rb,
lib/aws/iam/errors.rb,
lib/aws/iam/policy.rb,
lib/aws/iam/request.rb,
lib/aws/iam/resource.rb,
lib/aws/iam/access_key.rb,
lib/aws/iam/client/xml.rb,
lib/aws/iam/collection.rb,
lib/aws/iam/mfa_device.rb,
lib/aws/iam/user_policy.rb,
lib/aws/iam/login_profile.rb,
lib/aws/iam/user_collection.rb,
lib/aws/iam/group_collection.rb,
lib/aws/iam/policy_collection.rb,
lib/aws/iam/server_certificate.rb,
lib/aws/iam/signing_certificate.rb,
lib/aws/iam/access_key_collection.rb,
lib/aws/iam/group_user_collection.rb,
lib/aws/iam/mfa_device_collection.rb,
lib/aws/iam/user_group_collection.rb,
lib/aws/iam/user_policy_collection.rb,
lib/aws/iam/group_policy_collection.rb,
lib/aws/iam/account_alias_collection.rb,
lib/aws/iam/server_certificate_collection.rb,
lib/aws/iam/signing_certificate_collection.rb
Overview
This class is the starting point for working with AWS Identity and Access Management (IAM).
For more information about IAM:
Credentials
You can setup default credentials for all AWS services via AWS.config:
AWS.config(
:access_key_id => 'YOUR_ACCESS_KEY_ID',
:secret_access_key => 'YOUR_SECRET_ACCESS_KEY')
Or you can set them directly on the IAM interface:
iam = AWS::IAM.new(
:access_key_id => 'YOUR_ACCESS_KEY_ID',
:secret_access_key => 'YOUR_SECRET_ACCESS_KEY')
Account Summary
You can get account level information about entity usage and IAM quotas directly from an IAM interface object.
summary = iam.account_summary
puts "Num users: #{summary[:users]}"
puts "Num user quota: #{summary[:users_quota]}"
For a complete list of summary attributes see the #account_summary method.
Account Aliases
Currently IAM only supports a single account alias for each AWS account. You can set the account alias on the IAM interface.
iam.account_alias = 'myaccountalias'
iam.account_alias
#=> 'myaccountalias'
You can also remove your account alias:
iam.remove_account_alias
iam.account_alias
#=> nil
Access Keys
You can create up to 2 access for your account and 2 for each user. This makes it easy to rotate keys if you need to. You can also deactivate/activate access keys.
# get your current access key
old_access_key = iam.access_keys.first
# create a new access key
new_access_key = iam.access_keys.create
new_access_key.credentials
#=> { :access_key_id => 'ID', :secret_access_key => 'SECRET' }
# go rotate your keys/credentials ...
# now disable the old access key
old_access_key.deactivate!
# go make sure everything still works ...
# all done, lets clean up
old_access_key.delete
Users can also have access keys:
u = iam.users['someuser']
access_key = u.access_keys.create
access_key.credentials
#=> { :access_key_id => 'ID', :secret_access_key => 'SECRET' }
See AccessKeyCollection and AccessKey for more information about working with access keys.
Users & Groups
Each AWS account can have multiple users. Users can be used to easily manage permissions. Users can also be organized into groups.
user = iam.users.create('JohnDoe')
group = iam.groups.create('Developers')
# add a user to a group
user.groups.add(group)
# remove a user from a group
user.groups.remove(group)
# add a user to a group
group.users.add(user)
# remove a user from a group
group.users.remove(user)
See User, UserCollection, Group and GroupCollection for more information on how to work with users and groups.
Other Interfaces
Other useful IAM interfaces:
-
User Login Profiles (LoginProfile)
-
Policies (Policy)
-
Server Certificates (ServerCertificateCollection, ServerCertificate)
-
Signing Certificates (SigningCertificateCollection, SigningCertificate)
-
Multifactor Authentication Devices (MFADeviceCollection, MFADevice)
Defined Under Namespace
Modules: Collection, PolicyCollection Classes: AccessKey, AccessKeyCollection, Group, GroupCollection, GroupPolicyCollection, GroupUserCollection, LoginProfile, MFADevice, MFADeviceCollection, ServerCertificate, ServerCertificateCollection, SigningCertificate, SigningCertificateCollection, User, UserCollection, UserGroupCollection, UserPolicy, UserPolicyCollection
Instance Method Summary collapse
-
#access_keys ⇒ AccessKeyCollection
Returns a collection that represents the access keys for this AWS account.
-
#account_alias ⇒ String?
Returns the account alias.
-
#account_alias=(account_alias) ⇒ String
Sets the account alias for this AWS account.
-
#account_summary ⇒ Hash
Retrieves account level information about account entity usage and IAM quotas.
-
#groups ⇒ GroupCollection
Returns a collection that represents all AWS groups for this account:.
-
#remove_account_alias ⇒ nil
Deletes the account alias (if one exists).
-
#server_certificates ⇒ ServerCertificateCollection
Returns a collection that represents the server certificates for this AWS account.
-
#signing_certificates ⇒ SigningCertificateCollection
Returns a collection that represents the signing certificates for this AWS account.
-
#users ⇒ UserCollection
Returns a collection that represents all AWS users for this account:.
Instance Method Details
#access_keys ⇒ AccessKeyCollection
214 215 216 |
# File 'lib/aws/iam.rb', line 214 def access_keys AccessKeyCollection.new(:config => config) end |
#account_alias ⇒ String?
Returns the account alias. If this account has no alias, then nil
is returned.
267 268 269 |
# File 'lib/aws/iam.rb', line 267 def account_alias account_aliases.first end |
#account_alias=(account_alias) ⇒ String
Sets the account alias for this AWS account.
259 260 261 262 263 |
# File 'lib/aws/iam.rb', line 259 def account_alias= account_alias account_alias.nil? ? remove_account_alias : account_aliases.create(account_alias) end |
#account_summary ⇒ Hash
Retrieves account level information about account entity usage and IAM quotas. The returned hash contains the following keys:
:users
-
Number of users for the AWS account
:users_quota
-
Maximum users allowed for the AWS account
:groups
-
Number of Groups for the AWS account
:groups_quota
-
Maximum Groups allowed for the AWS account
:server_certificates
-
Number of Server Certificates for the AWS account
:server_certificates_quota
-
Maximum Server Certificates allowed for the AWS account
:user_policy_size_quota
-
Maximum allowed size for user policy documents (in kilobytes)
:group_policy_size_quota
-
Maximum allowed size for Group policy documents (in kilobyes)
:groups_per_user_quota
-
Maximum number of groups a user can belong to
:signing_certificates_per_user_quota
-
Maximum number of X509 certificates allowed for a user
:access_keys_per_user_quota
-
Maximum number of access keys that can be created per user
319 320 321 322 323 324 |
# File 'lib/aws/iam.rb', line 319 def account_summary client.get_account_summary.summary_map.inject({}) do |h, (k,v)| h[Core::Inflection.ruby_name(k).to_sym] = v h end end |
#groups ⇒ GroupCollection
Returns a collection that represents all AWS groups for this account:
200 201 202 |
# File 'lib/aws/iam.rb', line 200 def groups GroupCollection.new(:config => config) end |
#remove_account_alias ⇒ nil
Deletes the account alias (if one exists).
273 274 275 276 277 278 |
# File 'lib/aws/iam.rb', line 273 def remove_account_alias account_aliases.each do |account_alias| account_aliases.delete(account_alias) end nil end |
#server_certificates ⇒ ServerCertificateCollection
Currently, Amazon Elastic Load Balancing is the only service to support the use of server certificates with IAM. Using server certificates with Amazon Elastic Load Balancing is described in the Amazon Elastic Load Balancing Developer Guide.
Returns a collection that represents the server certificates for this AWS account.
iam = AWS::IAM.new
iam.server_certificates.each do |cert|
# ...
end
252 253 254 |
# File 'lib/aws/iam.rb', line 252 def server_certificates ServerCertificateCollection.new(:config => config) end |
#signing_certificates ⇒ SigningCertificateCollection
Returns a collection that represents the signing certificates for this AWS account.
iam = AWS::IAM.new
iam.signing_certificates.each do |cert|
# ...
end
If you need to access the signing certificates of a specific user, see AWS::IAM::User#signing_certificates.
231 232 233 |
# File 'lib/aws/iam.rb', line 231 def signing_certificates SigningCertificateCollection.new(:config => config) end |
#users ⇒ UserCollection
Returns a collection that represents all AWS users for this account:
182 183 184 |
# File 'lib/aws/iam.rb', line 182 def users UserCollection.new(:config => config) end |