service_specific_credentials

Creates, updates, deletes, gets or lists a service_specific_credentials resource.

Overview

Name	service_specific_credentials
Type	Resource
Id	aws.iam.service_specific_credentials

Fields

The following fields are returned by SELECT queries:

list_service_specific_credentials

Name	Datatype	Description
create_date	string	The date and time, in ISO 8601 date-time format, when the service-specific credential were created.
expiration_date	string	The date and time when the service specific credential expires. This field is only present for Bedrock API keys and CloudWatch Logs API keys that were created with an expiration period.
service_credential_alias	string	For Bedrock API keys and CloudWatch Logs API keys, this is the public portion of the credential that includes the IAM user name and a suffix containing version and creation information.
service_name	string	The name of the service associated with the service-specific credential.
service_specific_credential_id	string	The unique identifier for the service-specific credential.
service_user_name	string	The generated user name for the service-specific credential.
status	string	The status of the service-specific credential. Active means that the key is valid for API calls, while Inactive means it is not.
user_name	string	The name of the IAM user associated with the service-specific credential.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_service_specific_credentials	select	region	UserName, ServiceName, AllUsers, Marker, MaxItems	Returns information about the service-specific credentials associated with the specified IAM user. If none exists, the operation returns an empty list. The service-specific credentials returned by this operation are used only for authenticating the IAM user to a specific service. For more information about using service-specific credentials to authenticate to an Amazon Web Services service, refer to the following docs: For service-specific credentials with CodeCommit, refer to IAM credentials for CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys in the IAM User Guide. For service-specific credentials with Amazon Keyspaces (for Apache Cassandra), refer to Use IAM with Amazon Keyspaces (for Apache Cassandra) in the IAM User Guide. For services that support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.
create_service_specific_credential	insert	UserName, ServiceName, region	CredentialAgeDays	Generates a set of credentials consisting of a user name and password that can be used to access the service specified in the request. These credentials are generated by IAM, and can be used only for the specified service. You can have a maximum of two sets of service-specific credentials for each supported service per user. You can reset the password to a new service-generated value by calling ResetServiceSpecificCredential. For more information about using service-specific credentials to authenticate to an Amazon Web Services service, refer to the following docs: For service-specific credentials with CodeCommit, refer to IAM credentials for CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys in the IAM User Guide. For service-specific credentials with Amazon Keyspaces (for Apache Cassandra), refer to Use IAM with Amazon Keyspaces (for Apache Cassandra) in the IAM User Guide. For services that support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.
update_service_specific_credential	update	ServiceSpecificCredentialId, region	UserName, Status	Sets the status of a service-specific credential to Active or Inactive. Service-specific credentials that are inactive cannot be used for authentication to the service. This operation can be used to disable a user's service-specific credential as part of a credential rotation work flow.
delete_service_specific_credential	delete	ServiceSpecificCredentialId, region	UserName	Deletes the specified service-specific credential.
reset_service_specific_credential	exec	ServiceSpecificCredentialId, region	UserName	Resets the password for a service-specific credential. The new password is Amazon Web Services generated and cryptographically strong. It cannot be configured by the user. Resetting the password immediately invalidates the previous password associated with this user.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
ServiceName	string	The name of the Amazon Web Services service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.
ServiceSpecificCredentialId	string	The unique identifier of the service-specific credential. This parameter allows (through its regex pattern) a string of characters that can consist of any upper or lowercased letter or digit.
UserName	string	The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
region	string	AWS region (default: us-east-1)
AllUsers	boolean	A flag indicating whether to list service specific credentials for all users. This parameter cannot be specified together with UserName. When true, returns all credentials associated with the specified service.
CredentialAgeDays	integer	The number of days until the service specific credential expires. This field is only valid for services that support long-term API keys and must be a positive integer. When not specified, the credential will not expire. To see which services support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.
Marker	string	Use this parameter only when paginating results and only after you receive a response indicating that the results are truncated. Set it to the value of the Marker from the response that you received to indicate where the next call should start.
MaxItems	integer	Use this only when paginating results to indicate the maximum number of items you want in the response. If additional items exist beyond the maximum you specify, the IsTruncated response element is true.
ServiceName	string	Filters the returned results to only those for the specified Amazon Web Services service. If not specified, then Amazon Web Services returns service-specific credentials for all services.
Status	string	The status to be assigned to the service-specific credential.
UserName	string	The name of the IAM user associated with the service-specific credential. If this value is not specified, then the operation assumes the user whose credentials are used to call the operation. This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-

SELECT examples

list_service_specific_credentials

Returns information about the service-specific credentials associated with the specified IAM user. If none exists, the operation returns an empty list. The service-specific credentials returned by this operation are used only for authenticating the IAM user to a specific service. For more information about using service-specific credentials to authenticate to an Amazon Web Services service, refer to the following docs: For service-specific credentials with CodeCommit, refer to IAM credentials for CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys in the IAM User Guide. For service-specific credentials with Amazon Keyspaces (for Apache Cassandra), refer to Use IAM with Amazon Keyspaces (for Apache Cassandra) in the IAM User Guide. For services that support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.

SELECT
create_date,
expiration_date,
service_credential_alias,
service_name,
service_specific_credential_id,
service_user_name,
status,
user_name
FROM aws.iam.service_specific_credentials
WHERE region = '{{ region }}' -- required
AND UserName = '{{ UserName }}'
AND ServiceName = '{{ ServiceName }}'
AND AllUsers = '{{ AllUsers }}'
AND Marker = '{{ Marker }}'
AND MaxItems = '{{ MaxItems }}'
;

INSERT examples

create_service_specific_credential

Generates a set of credentials consisting of a user name and password that can be used to access the service specified in the request. These credentials are generated by IAM, and can be used only for the specified service. You can have a maximum of two sets of service-specific credentials for each supported service per user. You can reset the password to a new service-generated value by calling ResetServiceSpecificCredential. For more information about using service-specific credentials to authenticate to an Amazon Web Services service, refer to the following docs: For service-specific credentials with CodeCommit, refer to IAM credentials for CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys in the IAM User Guide. For service-specific credentials with Amazon Keyspaces (for Apache Cassandra), refer to Use IAM with Amazon Keyspaces (for Apache Cassandra) in the IAM User Guide. For services that support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.

INSERT INTO aws.iam.service_specific_credentials (
UserName,
ServiceName,
region,
CredentialAgeDays
)
SELECT 
'{{ UserName }}',
'{{ ServiceName }}',
'{{ region }}',
'{{ CredentialAgeDays }}'
RETURNING
create_date,
expiration_date,
service_credential_alias,
service_credential_secret,
service_name,
service_password,
service_specific_credential_id,
service_user_name,
status,
user_name
;

Manifest

# Description fields are for documentation purposes
- name: service_specific_credentials
props:
  - name: UserName
    value: "{{ UserName }}"
    description: Required parameter for the service_specific_credentials resource.
  - name: ServiceName
    value: "{{ ServiceName }}"
    description: Required parameter for the service_specific_credentials resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the service_specific_credentials resource.
  - name: CredentialAgeDays
    value: {{ CredentialAgeDays }}
    description: The number of days until the service specific credential expires. This field is only valid for services that support long-term API keys and must be a positive integer. When not specified, the credential will not expire. To see which services support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.
    description: The number of days until the service specific credential expires. This field is only valid for services that support long-term API keys and must be a positive integer. When not specified, the credential will not expire. To see which services support long-term API keys, refer to API keys for Amazon Web Services services in the IAM User Guide.

UPDATE examples

update_service_specific_credential

Sets the status of a service-specific credential to Active or Inactive. Service-specific credentials that are inactive cannot be used for authentication to the service. This operation can be used to disable a user's service-specific credential as part of a credential rotation work flow.

UPDATE aws.iam.service_specific_credentials
SET 
-- No updatable properties
WHERE 
ServiceSpecificCredentialId = '{{ ServiceSpecificCredentialId }}' --required
AND region = '{{ region }}' --required
AND UserName = '{{ UserName}}'
AND Status = '{{ Status}}';

DELETE examples

delete_service_specific_credential

Deletes the specified service-specific credential.

DELETE FROM aws.iam.service_specific_credentials
WHERE ServiceSpecificCredentialId = '{{ ServiceSpecificCredentialId }}' --required
AND region = '{{ region }}' --required
AND UserName = '{{ UserName }}'
;

Lifecycle Methods

reset_service_specific_credential

Resets the password for a service-specific credential. The new password is Amazon Web Services generated and cryptographically strong. It cannot be configured by the user. Resetting the password immediately invalidates the previous password associated with this user.

EXEC aws.iam.service_specific_credentials.reset_service_specific_credential 
@ServiceSpecificCredentialId='{{ ServiceSpecificCredentialId }}' --required, 
@region='{{ region }}' --required, 
@UserName='{{ UserName }}'
;