Skip to main content

AWS IAM EXTENSIONS

Every Swamp extension that covers AWS IAM, as published in the registry. Install any of them with swamp extension pull.

Extensions

Extension Version License Contents
@swamp/aws/iam 2026.10.13.1 - 13 behavior types
@sntxrr/aws-access-key 2026.10.14.1 MIT 1 behavior types
@webframp/aws/iam 2026.10.14.1 Apache-2.0 1 behavior types
@jentz/aws-iam-role-audit 2026.07.20.1 - 1 behavior types

@swamp/aws/iam

swamp extension pull @swamp/aws/iam

Behavior type @swamp/aws/iam/group

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
GroupName string no The name of the group to create. Do not include the path in this value. The group name must be unique within the account. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the group name. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name. If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging Resources in Templates. Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a Region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}.
ManagedPolicyArns array of string no The Amazon Resource Name (ARN) of the IAM policy you want to attach. For more information about ARNs, see Amazon Resource Names (ARNs) in the General Reference.
Path string no The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
Policies array of object {PolicyDocument: object, PolicyName: string} no Adds or updates an inline policy document that is embedded in the specified IAM group. To view AWS::IAM::Group snippets, see Declaring an Group Resource. The name of each inline policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail. For information about limits on the number of inline policies that you can embed in a group, see Limitations on Entities in the User Guide.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM Group -
get Get a IAM Group identifier
update Update a IAM Group -
delete Delete a IAM Group identifier
sync Sync IAM Group state from AWS -
list List IAM Group resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM Group resource state

Behavior type @swamp/aws/iam/group-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PolicyDocument object no The policy document. You must provide policies in JSON format in IAM. However, for CFN templates formatted in YAML, you can provide the policy in JSON or YAML format. CFN always converts a YAML policy to JSON format before submitting it to IAM. The regex pattern used to validate this parameter is a string of characters consisting of the following: Any printable ASCII character ranging from the space character ( \u0020) through the end of the ASCII character range The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF) The special characters tab ( \u0009), line feed ( \u000A), and carriage return ( \u000D)
PolicyName string yes The name of the policy document. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
GroupName string yes The name of the group to associate the policy with. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM GroupPolicy -
get Get a IAM GroupPolicy identifier
update Update a IAM GroupPolicy -
delete Delete a IAM GroupPolicy identifier
sync Sync IAM GroupPolicy state from AWS -

Data written:

Resource Description
state IAM GroupPolicy resource state

Behavior type @swamp/aws/iam/instance-profile

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Path string no The path to the instance profile. For more information about paths, see IAM Identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
Roles array of string yes The name of the role to associate with the instance profile. Only one role can be assigned to an EC2 instance at a time, and all applications on the instance share the same role and permissions.
InstanceProfileName string no The name of the instance profile to create. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM InstanceProfile -
get Get a IAM InstanceProfile identifier
update Update a IAM InstanceProfile -
delete Delete a IAM InstanceProfile identifier
sync Sync IAM InstanceProfile state from AWS -
list List IAM InstanceProfile resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM InstanceProfile resource state

Behavior type @swamp/aws/iam/managed-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Description string no A friendly description of the policy. Typically used to store information about the permissions defined in the policy. For example, "Grants access to production DynamoDB tables." The policy description is immutable. After a value is assigned, it cannot be changed.
Groups array of string no The name (friendly name, not ARN) of the group to attach the policy to. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
ManagedPolicyName string no The friendly name of the policy. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name. If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging Resources in Templates. Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a Region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}.
Path string no The path for the policy. For more information about paths, see IAM identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters. You cannot use an asterisk (*) in the path name.
PolicyDocument object yes The JSON policy document that you want to use as the content for the new policy. You must provide policies in JSON format in IAM. However, for CFN templates formatted in YAML, you can provide the policy in JSON or YAML format. CFN always converts a YAML policy to JSON format before submitting it to IAM. The maximum length of the policy document that you can pass in this operation, including whitespace, is listed below. To view the maximum character counts of a managed policy with no whitespaces, see IAM and character quotas. To learn more about JSON policy grammar, see Grammar of the IAM JSON policy language in the IAM User Guide. The regex pattern used to validate this parameter is a string of characters consisting of the following: Any printable ASCII character ranging from the space character ( \u0020) through the end of the ASCII character range The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF) The special characters tab ( \u0009), line feed ( \u000A), and carriage return ( \u000D)
Roles array of string no The name (friendly name, not ARN) of the role to attach the policy to. This parameter allows (per its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@- If an external policy (such as AWS::IAM::Policy or AWS::IAM::ManagedPolicy) has a Ref to a role and if a resource (such as AWS::ECS::Service) also has a Ref to the same role, add a DependsOn attribute to the resource to make the resource depend on the external policy. This dependency ensures that the role's policy is available throughout the resource's lifecycle. For example, when you delete a stack with an AWS::ECS::Service resource, the DependsOn attribute ensures that CFN deletes the AWS::ECS::Service resource before deleting its role's policy.
Users array of string no The name (friendly name, not ARN) of the IAM user to attach the policy to. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM ManagedPolicy -
get Get a IAM ManagedPolicy identifier
update Update a IAM ManagedPolicy -
delete Delete a IAM ManagedPolicy identifier
sync Sync IAM ManagedPolicy state from AWS -
list List IAM ManagedPolicy resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM ManagedPolicy resource state

Behavior type @swamp/aws/iam/oidcprovider

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ClientIdList array of string no -
Url string no -
ThumbprintList array of string no -
Tags array of object {Value: string, Key: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM OIDCProvider -
get Get a IAM OIDCProvider identifier
update Update a IAM OIDCProvider -
delete Delete a IAM OIDCProvider identifier
sync Sync IAM OIDCProvider state from AWS -
list List IAM OIDCProvider resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM OIDCProvider resource state

Behavior type @swamp/aws/iam/role

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AssumeRolePolicyDocument object yes The trust policy that is associated with this role. Trust policies define which entities can assume the role. You can associate only one trust policy with a role. For an example of a policy that can be used to assume a role, see Template Examples. For more information about the elements that you can use in an IAM policy, see Policy Elements Reference in the User Guide.
Description string no A description of the role that you provide.
ManagedPolicyArns array of string no A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the role. For more information about ARNs, see Amazon Resource Names (ARNs) and Service Namespaces in the General Reference.
MaxSessionDuration integer no The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can have a value from 1 hour to 12 hours. Anyone who assumes the role from the CLI or API can use the DurationSeconds API parameter or the duration-seconds CLI parameter to request a longer session. The MaxSessionDuration setting determines the maximum duration that can be requested using the DurationSeconds parameter. If users don't specify a value for the DurationSeconds parameter, their security credentials are valid for one hour by default. This applies when you use the AssumeRole* API operations or the assume-role* CLI operations but does not apply when you use those operations to create a console URL. For more information, see Using IAM roles in the IAM User Guide.
Path string no The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
PermissionsBoundary string no The ARN of the policy used to set the permissions boundary for the role. For more information about permissions boundaries, see Permissions boundaries for IAM identities in the IAM User Guide.
Policies array of object {PolicyDocument: object, PolicyName: string} no Adds or updates an inline policy document that is embedded in the specified IAM role. When you embed an inline policy in a role, the inline policy is used as part of the role's access (permissions) policy. The role's trust policy is created at the same time as the role. You can update a role's trust policy later. For more information about IAM roles, go to Using Roles to Delegate Permissions and Federate Identities. A role can also have an attached managed policy. For information about policies, see Managed Policies and Inline Policies in the User Guide. For information about limits on the number of inline policies that you can embed with a role, see Limitations on Entities in the User Guide. If an external policy (such as AWS::IAM::Policy or AWS::IAM::ManagedPolicy) has a Ref to a role and if a resource (such as AWS::ECS::Service) also has a Ref to the same role, add a DependsOn attribute to the resource to make the resource depend on the external policy. This dependency ensures that the role's policy is available throughout the resource's lifecycle. For example, when you delete a stack with an AWS::ECS::Service resource, the DependsOn attribute ensures that CFN deletes the AWS::ECS::Service resource before deleting its role's policy.
RoleName string no A name for the IAM role, up to 64 characters in length. For valid values, see the RoleName parameter for the CreateRole action in the User Guide. This parameter allows (per its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. The role name must be unique within the account. Role names are not distinguished by case. For example, you cannot create roles named both "Role1" and "role1". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the role name. If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging Resources in Templates. Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a Region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}.
Tags array of object {Key: string, Value: string} no A list of tags that are attached to the role. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM Role -
get Get a IAM Role identifier
update Update a IAM Role -
delete Delete a IAM Role identifier
sync Sync IAM Role state from AWS -
list List IAM Role resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM Role resource state

Behavior type @swamp/aws/iam/role-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PolicyDocument object no The policy document. You must provide policies in JSON format in IAM. However, for CFN templates formatted in YAML, you can provide the policy in JSON or YAML format. CFN always converts a YAML policy to JSON format before submitting it to IAM. The regex pattern used to validate this parameter is a string of characters consisting of the following: Any printable ASCII character ranging from the space character ( \u0020) through the end of the ASCII character range The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF) The special characters tab ( \u0009), line feed ( \u000A), and carriage return ( \u000D)
PolicyName string yes The name of the policy document. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
RoleName string yes The name of the role to associate the policy with. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM RolePolicy -
get Get a IAM RolePolicy identifier
update Update a IAM RolePolicy -
delete Delete a IAM RolePolicy identifier
sync Sync IAM RolePolicy state from AWS -

Data written:

Resource Description
state IAM RolePolicy resource state

Behavior type @swamp/aws/iam/samlprovider

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name string no -
SamlMetadataDocument string no -
Tags array of object {Value: string, Key: string} no -
AssertionEncryptionMode "Allowed" | "Required" no The encryption setting for the SAML provider
AddPrivateKey string no The private key from your external identity provider
RemovePrivateKey string no The Key ID of the private key to remove
PrivateKeyList array of object {KeyId: string, Timestamp: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM SAMLProvider -
get Get a IAM SAMLProvider identifier
update Update a IAM SAMLProvider -
delete Delete a IAM SAMLProvider identifier
sync Sync IAM SAMLProvider state from AWS -
list List IAM SAMLProvider resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM SAMLProvider resource state

Behavior type @swamp/aws/iam/server-certificate

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CertificateBody string no -
CertificateChain string no -
ServerCertificateName string no -
Path string no -
PrivateKey string no -
Tags array of object {Value: string, Key: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM ServerCertificate -
get Get a IAM ServerCertificate identifier
update Update a IAM ServerCertificate -
delete Delete a IAM ServerCertificate identifier
sync Sync IAM ServerCertificate state from AWS -
list List IAM ServerCertificate resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM ServerCertificate resource state

Behavior type @swamp/aws/iam/service-linked-role

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CustomSuffix string no A string that you provide, which is combined with the service-provided prefix to form the complete role name.
Description string no The description of the role.
AWSServiceName string no The service principal for the AWS service to which this role is attached.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM ServiceLinkedRole -
get Get a IAM ServiceLinkedRole identifier
update Update a IAM ServiceLinkedRole -
delete Delete a IAM ServiceLinkedRole identifier
sync Sync IAM ServiceLinkedRole state from AWS -

Data written:

Resource Description
state IAM ServiceLinkedRole resource state

Behavior type @swamp/aws/iam/user

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Path string no The path for the user name. For more information about paths, see IAM identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the! ( \u0021) through the DEL character ( \u007F), including most punctuation characters, digits, and upper and lowercased letters.
ManagedPolicyArns array of string no A list of Amazon Resource Names (ARNs) of the IAM managed policies that you want to attach to the user. For more information about ARNs, see Amazon Resource Names (ARNs) and Service Namespaces in the General Reference.
Policies array of object {PolicyDocument: object, PolicyName: string} no Adds or updates an inline policy document that is embedded in the specified IAM user. To view AWS::IAM::User snippets, see Declaring an User Resource. The name of each policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail. For information about limits on the number of inline policies that you can embed in a user, see Limitations on Entities in the User Guide.
UserName string no The name of the user to create. Do not include the path in this value. This parameter allows (per its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-. The user name must be unique within the account. User names are not distinguished by case. For example, you cannot create users named both "John" and "john". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the user name. If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging Resources in Templates. Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a Region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}.
Groups array of string no A list of group names to which you want to add the user.
LoginProfile object {PasswordResetRequired?: boolean, Password: string} no Creates a password for the specified IAM user. A password allows an IAM user to access AWS services through the console. You can use the CLI, the AWS API, or the Users page in the IAM console to create a password for any IAM user. Use ChangePassword to update your own existing password in the My Security Credentials page in the console. For more information about managing passwords, see Managing passwords in the User Guide.
Tags array of object {Key: string, Value: string} no A list of tags that you want to attach to the new user. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide. If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
PermissionsBoundary string no The ARN of the managed policy that is used to set the permissions boundary for the user. A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an entity, but does not grant permissions. Permissions boundaries do not define the maximum permissions that a resource-based policy can grant to an entity. To learn more, see Permissions boundaries for IAM entities in the IAM User Guide. For more information about policy types, see Policy types in the IAM User Guide.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM User -
get Get a IAM User identifier
update Update a IAM User -
delete Delete a IAM User identifier
sync Sync IAM User state from AWS -
list List IAM User resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM User resource state

Behavior type @swamp/aws/iam/user-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PolicyDocument object no The policy document. You must provide policies in JSON format in IAM. However, for CFN templates formatted in YAML, you can provide the policy in JSON or YAML format. CFN always converts a YAML policy to JSON format before submitting it to IAM. The regex pattern used to validate this parameter is a string of characters consisting of the following: Any printable ASCII character ranging from the space character ( \u0020) through the end of the ASCII character range The printable characters in the Basic Latin and Latin-1 Supplement character set (through \u00FF) The special characters tab ( \u0009), line feed ( \u000A), and carriage return ( \u000D)
PolicyName string yes The name of the policy document. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
UserName string yes The name of the user to associate the policy with. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM UserPolicy -
get Get a IAM UserPolicy identifier
update Update a IAM UserPolicy -
delete Delete a IAM UserPolicy identifier
sync Sync IAM UserPolicy state from AWS -

Data written:

Resource Description
state IAM UserPolicy resource state

Behavior type @swamp/aws/iam/virtual-mfadevice

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
VirtualMfaDeviceName string no -
Path string no -
Users array of string yes -
Tags array of object {Value: string, Key: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a IAM VirtualMFADevice -
get Get a IAM VirtualMFADevice identifier
update Update a IAM VirtualMFADevice -
delete Delete a IAM VirtualMFADevice identifier
sync Sync IAM VirtualMFADevice state from AWS -
list List IAM VirtualMFADevice resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state IAM VirtualMFADevice resource state

@sntxrr/aws-access-key

swamp extension pull @sntxrr/aws-access-key

Behavior type @sntxrr/aws-access-key

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
userName string yes The IAM user whose access keys this instance manages.
region string no Region the IAM client signs for. IAM is global; leave the default unless your partition needs otherwise.
targetVault string no Name of the Swamp vault create writes the new key into. Required by create; list/deactivate/delete do not use it.
targetItem string no Item within targetVault. create writes /access-key-id and /secret-access-key.

Methods, run with swamp behavior run:

Method Description Arguments
list Inventory the user's access keys with status, age and last use. -
create Mint a new access key and write both halves into targetVault/targetItem, verified by read-back. Rolls the key back if delivery fails. allowSecond (optional)
deactivate Set one key Inactive — the reversible step before delete in a rotation. accessKeyId
delete Delete one key. Refuses an Active key — deactivate it first, so a still-used key fails loudly and reversibly before it is gone. accessKeyId

Data written:

Resource Description
key One access key's metadata and fingerprints. Never the secret.
inventory Every key the user holds as of one list call.

@webframp/aws/iam

swamp extension pull @webframp/aws/iam

Behavior type @webframp/aws/iam

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
profiles array of string yes AWS CLI profile names to scan (one per account)
pathPrefix string no IAM path prefix filter (default: / for all roles)
excludeServiceLinked boolean no Exclude AWS service-linked roles from discovery
excludeAwsManagedPolicies boolean no Only discover customer-managed policies

Methods, run with swamp behavior run:

Method Description Arguments
discover_roles Discover IAM roles across all configured profiles. Captures trust policies, attached managed policies, inline policy names, last-used timestamps, and permission boundaries. Produces one 'roles' resource per account. profiles (optional)
discover_users Discover IAM users across all configured profiles. Captures MFA status, access key age/last-used, and attached policies. Produces one 'users' resource per account. profiles (optional)
discover_policies Discover customer-managed IAM policies across all configured profiles. Captures policy metadata (attachment count, version). Produces one 'policies' resource per account. profiles (optional)
discover_trust_map Build a cross-account trust graph from previously discovered roles. Reads all 'roles' resources and extracts trust relationships, categorizing them as cross-account AWS trusts, service trusts, or external (unknown account) trusts. Run discover_roles first. profiles (optional)
discover_all Orchestrate full IAM discovery: roles, users, policies, then trust map. Equivalent to running discover_roles, discover_users, discover_policies, and discover_trust_map in sequence. profiles (optional)

Data written:

Resource Description
roles IAM roles per account with trust policies and attached permissions
users IAM users per account with MFA status and access key metadata
policies Customer-managed IAM policies per account
trustMap Cross-account trust graph derived from role trust policies

@jentz/aws-iam-role-audit

swamp extension pull @jentz/aws-iam-role-audit

Behavior type @jentz/aws-iam-role-audit

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
roles array of object {roleName: string, expectedManagedPolicyArns: array of string, expectedCustomerPolicyNames: array of string, expectedTrustPrincipals: array of string, expectedExternalId: string, required: boolean} no The integration's roles, each with its own expectations and required flag. At least one role must be configured.
profiles array of string no Named AWS profiles to sweep, one account each. Empty uses the ambient credential chain as a single account.
stackLookupRegions array of string no REQUIRED. Regions searched (in order) for the CloudFormation stack that owns a role, to classify the management mechanism. No default: the wrong region misclassifies a CFN-managed role as 'manual', so the audit fails closed (descriptive throw) when this is unset or empty.
requiredProfileSuffix string no If set, every profile must end with this suffix or it is refused before any AWS call (e.g. '-readonly'). Default '' disables the check.
region string no Region for the IAM/STS client endpoint. IAM is global; us-east-1 is safe.
ssoSession string no Name of the shared AWS SSO session backing the swept profiles (the [sso-session <name>] block in ~/.aws/config). When set, the audit pre-flights this session's cached token once before the per-profile loop: a genuinely expired token short-circuits the whole sweep with a single 'run aws sso login' error rather than failing every profile. Empty (default) skips the pre-flight entirely.

Methods, run with swamp behavior run:

Method Description Arguments
audit Read-only fan-out: for each configured role, sweep every profile (account) and capture existence, attached/inline policies, trust principals + external ids, the owning CloudFormation stack (to classify mechanism), and compliance against the role's expectations. One role row per (account, role). -

Data written:

Resource Description
role One integration role observed (or absent) in one account, with its policies, trust principals, external ids, management mechanism (stackset/standalone/manual/missing, from the owning CFN stack), required flag, and compliance findings.
scan_error A profile (or profile × role) that could not be assessed — expired SSO token, denied call, etc. Surfaces coverage gaps in the report.