User
Provides an IAM user.
NOTE: If policies are attached to the user via the
aws.iam.PolicyAttachmentresource and you are modifying the usernameorpath, theforce_destroyargument must be set totrueand applied before attempting the operation otherwise you will encounter aDeleteConflicterror. Theaws.iam.UserPolicyAttachmentresource (recommended) does not have this requirement.
Example Usage
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.User;
import com.pulumi.aws.iam.UserArgs;
import com.pulumi.aws.iam.AccessKey;
import com.pulumi.aws.iam.AccessKeyArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.UserPolicy;
import com.pulumi.aws.iam.UserPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var lbUser = new User("lbUser", UserArgs.builder()
.path("/system/")
.tags(Map.of("tag-key", "tag-value"))
.build());
var lbAccessKey = new AccessKey("lbAccessKey", AccessKeyArgs.builder()
.user(lbUser.name())
.build());
final var lbRoPolicyDocument = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
.statements(GetPolicyDocumentStatementArgs.builder()
.effect("Allow")
.actions("ec2:Describe*")
.resources("*")
.build())
.build());
var lbRoUserPolicy = new UserPolicy("lbRoUserPolicy", UserPolicyArgs.builder()
.user(lbUser.name())
.policy(lbRoPolicyDocument.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
.build());
}
}Import
IAM Users can be imported using the name, e.g.,
$ pulumi import aws:iam/user:User lb loadbalancerProperties
When destroying this user, destroy even if it has non-provider-managed IAM access keys, login profile or MFA devices. Without force_destroy a user with non-provider-managed access keys and login profile will fail to be destroyed.
The user's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: =,.@-_.. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
The ARN of the policy that is used to set the permissions boundary for the user.