AWS Identity and Access Management
CLI Reference (API Version 2010-05-08)
« PreviousNext »
View the PDF for this guide.Go to the AWS Discussion Forum for this product.Did this page help you?  Yes | No |  Tell us about it...

iam-useraddpolicy

Description

Creates a policy based on the information you provide and attaches the policy to the specified user. Use this command if you need a simple policy with no conditions, and you don't want to write the policy yourself. If you need a policy with conditions, you must write the policy yourself and upload it with iam-useruploadpolicy. For information about the contents of policies, refer to Using AWS Identity and Access Management.

A user can have only a limited number of policies. For more information, see Appendix A: Limitations on IAM Entities.

Syntax

iam-useraddpolicy -u USERNAME -p POLICYNAME -e EFFECT {-a ACTION ...} {-r AMAZON RESOURCE NAME ...} [-o]

Options

Name Description Required

-u USERNAME

Name of the user the policy is for.

Type: String

Default: None

Yes

-p POLICYNAME

Name you want to assign the policy.

Type: String

Default: None

Yes

-e EFFECT

The value for the policy's Effect element. Specifies whether the policy results in an allow or a deny. For more information about policies and their contents, refer to Using AWS Identity and Access Management.

Type: String

Valid Values: Allow | Deny

Default: None

Yes

-a ACTION

The value for the policy's Action element. Specifies the service and action you want to allow or deny permission to. For example: -a iam:ListAccessKeys.

You can use wildcards, and you can specify more than one -a Action option in the request.

The following example specifies all the IAM actions related to access keys or signing certificates: -a iam:*AccessKey* -a iam:*SigningCertificate*

Type: String

Default: None

Yes

-r AMAZON RESOURCE NAME

The value for the policy's Resource element. Specifies the Amazon Resource Name (ARN) for the resource (or resources) the policy applies to.

You can use wildcards, and you can specify more than one -r AMAZON RESOURCE NAME option in the request. The following example specifies all the resources in the AWS account: -r "*" (quotation marks are required if you're just specifying * as the resource). The following example specifies all groups in the AWS account: -r arn:aws:iam::123456789012:group/*

Type: String

Default: None

Yes

-o

Causes the output to include the JSON policy document that IAM created for you.

No

Output

If the command is successful, the output is empty. Exception: if you specified the -o option, the output includes the JSON policy document.

Example

The following example request adds (or updates) the policy named AdminRoot for the user named Bob. The -o option causes the output to include the JSON policy document we construct for you based on the options you provided.

PROMPT> iam-useraddpolicy -u Bob -p AdminRoot -e Allow -a "*" -r "*" -o
				
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["*"],"Resource":["*"]}]}