Skip to main content

groups

Creates, updates, deletes or gets a group resource or lists groups in a region

Overview​

Namegroups
TypeResource
Description
Creates a new group.For information about the number of groups you can create, see Limitations on Entities in the User Guide.
Idawscc.iam.groups

Fields​

NameDatatypeDescription
arnstring
group_namestring
The name of the group to create. Do not include the path in this value.The group name must be unique within the account. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins". If you don't specify a name, CFN generates a unique physical ID and uses that ID for the group name.
If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging Resources in Templates.
Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple Regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a Region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]}.
managed_policy_arnsarray
The Amazon Resource Name (ARN) of the IAM policy you want to attach.For more information about ARNs, see Amazon Resource Names (ARNs) in the General Reference.
pathstring
The path to the group. For more information about paths, see IAM identifiers in the IAM User Guide.This parameter is optional. If it is not included, it defaults to a slash (/).
This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.
▶policiesarray
Adds or updates an inline policy document that is embedded in the specified IAM group. To view AWS::IAM::Group snippets, see Declaring an Group Resource.The name of each inline policy for a role, user, or group must be unique. If you don't choose unique names, updates to the IAM identity will fail.
For information about limits on the number of inline policies that you can embed in a group, see Limitations on Entities in the User Guide.
regionstringAWS region.

For more information, see AWS::IAM::Group.

Methods​

NameResourceAccessible byRequired Params
create_resourcegroupsINSERTregion
delete_resourcegroupsDELETEIdentifier, region
update_resourcegroupsUPDATEIdentifier, PatchDocument, region
list_resourcesgroups_list_onlySELECTregion
get_resourcegroupsSELECTIdentifier, region

SELECT examples​

Gets all properties from an individual group.

SELECT
  region,
  arn,
  group_name,
  managed_policy_arns,
  path,
  policies
FROM awscc.iam.groups
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ group_name }}';

INSERT example​

Use the following StackQL query and manifest file to create a new group resource, using stack-deploy.

/*+ create */
INSERT INTO awscc.iam.groups (
  GroupName,
  ManagedPolicyArns,
  Path,
  Policies,
  region
)
SELECT
  '{{ group_name }}',
  '{{ managed_policy_arns }}',
  '{{ path }}',
  '{{ policies }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

UPDATE example​

Use the following StackQL query and manifest file to update a group resource, using stack-deploy.

/*+ update */
UPDATE awscc.iam.groups
SET PatchDocument = string('{{ {
    "ManagedPolicyArns": managed_policy_arns,
    "Path": path,
    "Policies": policies
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ group_name }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

DELETE example​

/*+ delete */
DELETE FROM awscc.iam.groups
WHERE
  Identifier = '{{ group_name }}' AND
  region = 'us-east-1'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters​

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

ParameterDescription
ClientToken
A unique identifier to ensure the idempotency of the resource request.This allows the provider to accurately distinguish between retries and new requests.
A client token is valid for 36 hours once used.
After that, a resource request with the same client token is treated as a new request.
If you do not specify a client token, one is generated for inclusion in the request.
RoleArn
The ARN of the IAM role used to perform this resource operation.The role specified must have the permissions required for this operation.
If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId
For private resource types, the type version to use in this resource operation.If you do not specify a resource version, the default version is used.

Permissions​

To operate on the groups resource, the following permissions are required:

iam:CreateGroup,
iam:PutGroupPolicy,
iam:AttachGroupPolicy,
iam:GetGroupPolicy,
iam:GetGroup