groups

Creates, updates, deletes or gets a group resource or lists groups in a region

Overview

Name	groups
Type	Resource
Description	Creates a new group. For information about the number of groups you can create, see [Limitations on Entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the *User Guide*.
Id	awscc.iam.groups

Fields

get (all properties)

Name	Datatype	Description
arn	string
group_name	string	The name of the group to create. Do not include the path in this value.<br />The group name must be unique within the account. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the group name.<br />If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.<br />If you specify a name, you must specify the &#96;&#96;CAPABILITY&#95;NAMED&#95;IAM&#96;&#96; value to acknowledge your template's capabilities. For more information, see &#91;Acknowledging Resources in Templates&#93;(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities).<br />Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using &#96;&#96;Fn::Join&#96;&#96; and &#96;&#96;AWS::Region&#96;&#96; to create a Region-specific name, as in the following example: &#96;&#96;&#123;"Fn::Join": &#91;"", &#91;&#123;"Ref": "AWS::Region"&#125;, &#123;"Ref": "MyResourceName"&#125;&#93;&#93;&#125;&#96;&#96;.
managed_policy_arns	array	The Amazon Resource Name (ARN) of the IAM policy you want to attach.<br />For more information about ARNs, see &#91;Amazon Resource Names (ARNs)&#93;(https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) in the &#42;General Reference&#42;.
path	string	The path to the group. For more information about paths, see &#91;IAM identifiers&#93;(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using&#95;Identifiers.html) in the &#42;IAM User Guide&#42;.<br />This parameter is optional. If it is not included, it defaults to a slash (/).<br />This parameter allows (through its &#91;regex pattern&#93;(https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex)) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (&#96;&#96;\u0021&#96;&#96;) through the DEL character (&#96;&#96;\u007F&#96;&#96;), including most punctuation characters, digits, and upper and lowercased letters.
▶policies	array	Adds or updates an inline policy document that is embedded in the specified IAM group. To view AWS::IAM::Group snippets, see &#91;Declaring an Group Resource&#93;(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-iam.html#scenario-iam-group).<br />The name of each inline policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail. <br />For information about limits on the number of inline policies that you can embed in a group, see &#91;Limitations on Entities&#93;(https://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html) in the &#42;User Guide&#42;.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
group_name	string	The name of the group to create. Do not include the path in this value.<br />The group name must be unique within the account. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the group name.<br />If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.<br />If you specify a name, you must specify the &#96;&#96;CAPABILITY&#95;NAMED&#95;IAM&#96;&#96; value to acknowledge your template's capabilities. For more information, see &#91;Acknowledging Resources in Templates&#93;(https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-capabilities).<br />Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using &#96;&#96;Fn::Join&#96;&#96; and &#96;&#96;AWS::Region&#96;&#96; to create a Region-specific name, as in the following example: &#96;&#96;&#123;"Fn::Join": &#91;"", &#91;&#123;"Ref": "AWS::Region"&#125;, &#123;"Ref": "MyResourceName"&#125;&#93;&#93;&#125;&#96;&#96;.
region	string	AWS region.

For more information, see AWS::IAM::Group.

Methods

Name	Resource	Accessible by	Required Params
create_resource	groups	INSERT	region
delete_resource	groups	DELETE	Identifier, region
update_resource	groups	UPDATE	Identifier, PatchDocument, region
list_resources	groups_list_only	SELECT	region
get_resource	groups	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual group.

SELECT
  region,
  arn,
  group_name,
  managed_policy_arns,
  path,
  policies
FROM awscc.iam.groups
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ group_name }}';

list (identifiers only)

Lists all groups in a region.

SELECT
  region,
  group_name
FROM awscc.iam.groups_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new group resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.iam.groups (
  GroupName,
  ManagedPolicyArns,
  Path,
  Policies,
  region
)
SELECT
  '{{ group_name }}',
  '{{ managed_policy_arns }}',
  '{{ path }}',
  '{{ policies }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.iam.groups (
  GroupName,
  ManagedPolicyArns,
  Path,
  Policies,
  region
)
SELECT
  '{{ group_name }}',
  '{{ managed_policy_arns }}',
  '{{ path }}',
  '{{ policies }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: group
    props:
      - name: group_name
        value: '{{ group_name }}'
      - name: managed_policy_arns
        value:
          - '{{ managed_policy_arns[0] }}'
      - name: path
        value: '{{ path }}'
      - name: policies
        value:
          - policy_document: {}
            policy_name: '{{ policy_name }}'

UPDATE example

Use the following StackQL query and manifest file to update a group resource, using stack-deploy.

/*+ update */
UPDATE awscc.iam.groups
SET PatchDocument = string('{{ {
    "ManagedPolicyArns": managed_policy_arns,
    "Path": path,
    "Policies": policies
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ group_name }}';

DELETE example

/*+ delete */
DELETE FROM awscc.iam.groups
WHERE
  Identifier = '{{ group_name }}' AND
  region = 'us-east-1';

Permissions

To operate on the groups resource, the following permissions are required:

Create

iam:CreateGroup,
iam:PutGroupPolicy,
iam:AttachGroupPolicy,
iam:GetGroupPolicy,
iam:GetGroup

Read

iam:GetGroup,
iam:ListGroupPolicies,
iam:GetGroupPolicy,
iam:ListAttachedGroupPolicies

Update

iam:GetGroup,
iam:UpdateGroup,
iam:DetachGroupPolicy,
iam:AttachGroupPolicy,
iam:DeleteGroupPolicy,
iam:PutGroupPolicy,
iam:GetGroupPolicy

Delete

iam:GetGroup,
iam:DeleteGroup,
iam:ListAttachedGroupPolicies,
iam:ListGroupPolicies,
iam:DetachGroupPolicy,
iam:DeleteGroupPolicy,
iam:GetGroupPolicy

List

iam:ListGroups