Response Elements

The following element is returned by the service.

AccessKey

A structure with details about the access key.

Type: AccessKey (p. 479) object

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

Examples

LimitExceeded

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded.

HTTP Status Code: 409 NoSuchEntity

The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.

HTTP Status Code: 404 ServiceFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500

Examples

Example

This example illustrates one usage of CreateAccessKey.

Sample Request

https://iam.amazonaws.com/?Action=CreateAccessKey

&UserName=Bob

&Version=2010-05-08

&AUTHPARAMS

Sample Response

<AccessKeyId>AKIAIOSFODNN7EXAMPLE</AccessKeyId>

<Status>Active</Status>

<SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY </SecretAccessKey>

</AccessKey>

</CreateAccessKeyResult>

<RequestId>7a62c49f-347e-4fc4-9331-6e8eEXAMPLE</RequestId>

</ResponseMetadata>

</CreateAccessKeyResponse>

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters (p. 563).

AccountAlias

The account alias to create.

This parameter allows (through its regex pattern) a string of characters consisting of lowercase letters, digits, and dashes. You cannot start or ﬁnish with a dash, nor can you have two dashes in a row.

Type: String

Length Constraints: Minimum length of 3. Maximum length of 63.

Pattern: ^[a-z0-9](([a-z0-9]|-(?!-))*[a-z0-9])?$

Required: Yes

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

EntityAlreadyExists

The request was rejected because it attempted to create a resource that already exists.

HTTP Status Code: 409 LimitExceeded

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded.

HTTP Status Code: 409 ServiceFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500

Examples

Example

This example illustrates one usage of CreateAccountAlias.

See Also

Sample Request

https://iam.amazonaws.com/?Action=CreateAccountAlias

&AccountAlias=example-corporation

&Version=2010-05-08

&AUTHPARAMS

Sample Response

<RequestId>36b5db08-f1b0-11df-8fbe-45274EXAMPLE</RequestId>

</ResponseMetadata>

</CreateAccountAliasResponse>

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters (p. 563).

GroupName

The name of the group to create. Do not include the path in this value.

IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "MyResource" and

"myresource".

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [\w+=,.@-]+

Required: Yes Path

The path to the group. For more information about paths, see IAM identiﬁers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 512.

Pattern: (\u002F)|(\u002F[\u0021-\u007F]+\u002F) Required: No

The following element is returned by the service.

Group

A structure containing details about the new group.

Type: Group (p. 496) object

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

EntityAlreadyExists

The request was rejected because it attempted to create a resource that already exists.

HTTP Status Code: 409 LimitExceeded

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded.

HTTP Status Code: 409 NoSuchEntity

The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.

HTTP Status Code: 404 ServiceFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500

Examples

Example

This example illustrates one usage of CreateGroup.

Sample Request

https://iam.amazonaws.com/?Action=CreateGroup

&GroupName=Admins

&Version=2010-05-08

&AUTHPARAMS

Sample Response

<Group>

<GroupName>Admins</GroupName>

<GroupId>AGPACKCEVSQ6C2EXAMPLE</GroupId>

<Arn>arn:aws:iam::123456789012:group/Admins</Arn>

</Group>

</CreateGroupResult>

<RequestId>7a62c49f-347e-4fc4-9331-6e8eEXAMPLE</RequestId>

</ResponseMetadata>

</CreateGroupResponse>

See Also

For more information about using this API in one of the language-speciﬁc AWS SDKs, see the following:

• AWS Command Line Interface

• AWS SDK for .NET

• AWS SDK for C++

• AWS SDK for Go

• AWS SDK for Java V2

• AWS SDK for JavaScript

• AWS SDK for PHP V3

• AWS SDK for Python

• AWS SDK for Ruby V3

CreateInstanceProﬁle

Creates a new instance proﬁle. For information about instance proﬁles, see Using roles for applications on Amazon EC2 in the IAM User Guide, and Instance proﬁles in the Amazon EC2 User Guide.

For information about the number of instance proﬁles you can create, see IAM object quotas in the IAM User Guide.

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters (p. 563).

InstanceProﬁleName

The name of the instance proﬁle to create.

This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters:

_+=,.@-Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [\w+=,.@-]+

Required: Yes Path

The path to the instance proﬁle. For more information about paths, see IAM Identiﬁers in the IAM User Guide.

This parameter is optional. If it is not included, it defaults to a slash (/).

Type: String

Length Constraints: Minimum length of 1. Maximum length of 512.

Pattern: (\u002F)|(\u002F[\u0021-\u007F]+\u002F) Required: No

Tags.member.N

A list of tags that you want to attach to the newly created IAM instance proﬁle. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

NoteIf any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Type: Array of Tag (p. 553) objects

Array Members: Maximum number of 50 items.

Response Elements

Required: No

Response Elements

The following element is returned by the service.

InstanceProﬁle

A structure containing details about the new instance proﬁle.

Type: InstanceProﬁle (p. 500) object

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

ConcurrentModiﬁcation

The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.

HTTP Status Code: 409 EntityAlreadyExists

The request was rejected because it attempted to create a resource that already exists.

HTTP Status Code: 409 InvalidInput

The request was rejected because an invalid or out-of-range value was supplied for an input parameter.

HTTP Status Code: 400 LimitExceeded

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded.

HTTP Status Code: 409 ServiceFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500

Examples

Example

This example illustrates one usage of CreateInstanceProﬁle.

Sample Request

https://iam.amazonaws.com/?Action=CreateInstanceProfile

See Also

&InstanceProfileName=Webserver

&Path=/application_abc/component_xyz/

&Version=2010-05-08

&AUTHPARAMS

Sample Response

<InstanceProfileId>AIPAD5ARO2C5EXAMPLE3G</InstanceProfileId>

<InstanceProfileName>Webserver</InstanceProfileName>

<Path>/application_abc/component_xyz/</Path>

<Arn>arn:aws:iam::123456789012:instance-profile/application_abc/component_xyz/

Webserver</Arn>

</InstanceProfile>

</CreateInstanceProfileResult>

<RequestId>974142ee-99f1-11e1-a4c3-27EXAMPLE804</RequestId>

</ResponseMetadata>

</CreateInstanceProfileResponse>

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters (p. 563).

Password

The new password for the user.

The regex pattern that is used to validate this parameter is a string of characters. That string can include almost any printable ASCII character from the space (\u0020) through the end of the ASCII character range (\u00FF). You can also include the tab (\u0009), line feed (\u000A), and carriage return (\u000D) characters. Any of these characters are valid in a password. However, many tools, such as the AWS Management Console, might restrict the ability to type certain characters because they have special meaning within that tool.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [\u0009\u000A\u000D\u0020-\u00FF]+

Required: Yes PasswordResetRequired

Speciﬁes whether the user is required to set a new password on next sign-in.

Type: Boolean Required: No UserName

The name of the IAM user to create a password for. The user must already exist.

_+=,.@-Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

Pattern: [\w+=,.@-]+

Required: Yes

Response Elements

The following element is returned by the service.

LoginProﬁle

A structure containing the user name and password create date.

Type: LoginProﬁle (p. 503) object

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

EntityAlreadyExists

The request was rejected because it attempted to create a resource that already exists.

HTTP Status Code: 409 LimitExceeded

The request was rejected because it attempted to create resources beyond the current AWS account limits. The error message describes the limit exceeded.

HTTP Status Code: 409 NoSuchEntity

The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.

HTTP Status Code: 404 PasswordPolicyViolation

The request was rejected because the provided password did not meet the requirements imposed by the account password policy.

HTTP Status Code: 400 ServiceFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500

Examples

Example

This example illustrates one usage of CreateLoginProﬁle.

Sample Request

https://iam.amazonaws.com/?Action=CreateLoginProfile

&UserName=Bob

&Password=h]6EszR}vJ*m

&Version=2010-05-08

See Also

&AUTHPARAMS

Sample Response

<PasswordResetRequired>false</PasswordResetRequired>

</LoginProfile>

</CreateLoginProfileResult>

<RequestId>7a62c49f-347e-4fc4-9331-6e8eEXAMPLE</RequestId>

</ResponseMetadata>

</CreateLoginProfileResponse>

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters (p. 563).

ClientIDList.member.N

Provides a list of client IDs, also known as audiences. When a mobile or web app registers with an OpenID Connect provider, they establish a value that identiﬁes the application. This is the value that's sent as the client_id parameter on OAuth requests.

You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider.

There is no deﬁned format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 characters long.

Type: Array of strings

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: No

Response Elements

Tags.member.N

A list of tags that you want to attach to the new IAM OpenID Connect (OIDC) provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

NoteIf any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.

Type: Array of Tag (p. 553) objects

Array Members: Maximum number of 50 items.

Required: No

ThumbprintList.member.N

A list of server certiﬁcate thumbprints for the OpenID Connect (OIDC) identity provider's server certiﬁcates. Typically this list includes only one entry. However, IAM lets you have up to ﬁve thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certiﬁcates.

The server certiﬁcate thumbprint is the hex-encoded SHA-1 hash value of the X.509 certiﬁcate used by the domain where the OpenID Connect provider makes its keys available. It is always a 40-character string.

You must provide at least one thumbprint when creating an IAM OIDC provider. For example, assume that the OIDC provider is server.example.com and the provider stores its keys at https://

keys.server.example.com/openid-connect. In that case, the thumbprint string would be the hex-encoded SHA-1 hash value of the certiﬁcate used by https://keys.server.example.com.

For more information about obtaining the OIDC provider thumbprint, see Obtaining the thumbprint for an OpenID Connect provider in the IAM User Guide.

Type: Array of strings

Length Constraints: Fixed length of 40.

Required: Yes Url

The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://

server.example.org or https://example.com. The URL should not contain a port number.

You cannot register the same provider multiple times in a single AWS account. If you try to submit a URL that has already been used for an OpenID Connect provider in the AWS account, you will get an error.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: Yes

Response Elements

The following elements are returned by the service.

Errors

OpenIDConnectProviderArn

The Amazon Resource Name (ARN) of the new IAM OpenID Connect provider that is created. For more information, see OpenIDConnectProviderListEntry (p. 508).

Type: String

Length Constraints: Minimum length of 20. Maximum length of 2048.

Tags.member.N

A list of tags that are attached to the new IAM OIDC provider. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.

Type: Array of Tag (p. 553) objects

Array Members: Maximum number of 50 items.

Errors

For information about the errors that are common to all actions, see Common Errors (p. 565).

在文檔中 AWS Identity and Access Management API Reference API Version 2010-05-08 (頁 45-80)