AWS IAM component

Q: How do I create an access key for a user?

Use operation=createAccessKey with CamelAwsIAMUsername. The body is {accessKeyId, secretAccessKey, status}: store it right away, for example in Secrets Manager, since the secret cannot be read again.

The aws2-iam component manages AWS IAM users, groups, access keys, roles, policies and instance profiles.

Scheme: aws2-iam: · Crate: cameleer-cloud · Cargo feature: cloud · Consumer: no · Producer: yes · Apache Camel: AWS Identity and Access Management (IAM)

When to use it

Onboard and offboard users from an HR or ticket system.
Rotate access keys on a schedule.
Create roles and attach policies as part of environment automation.

URI format

text

aws2-iam://label?operation=...[&options]

IAM is a global service: requests go to iam.amazonaws.com, signed for us-east-1.

Example

Create an IAM user for every user name that arrives on an onboarding queue:

yaml example: aws2-iam-onboard-users

- route:
    id: onboard-users
    from:
      uri: "aws2-sqs://onboarding?region={{env:AWS_REGION:us-east-1}}"
      steps:
        - setHeader:
            name: CamelAwsIAMUsername
            simple: "${body}"
        - to: "aws2-iam://iam?operation=createUser"
        - log: "created IAM user ${body[userName]} (${body[arn]})"

The body after createUser is the user map {userName, userId, arn, path, createDate}.

Rust DSL

rust

ctx.add_routes(|b| {
    b.from("aws2-sqs://onboarding?region={{env:AWS_REGION:us-east-1}}")
        .set_header("CamelAwsIAMUsername", simple("${body}"))
        .to("aws2-iam://iam?operation=createUser")
        .log("created IAM user ${body[userName]} (${body[arn]})");
})?;

Options

Common AWS options (credentials, endpoint override, proxy) are listed in Cloud credentials.

option	default	description
`operation`		Required. Users and keys: `createUser`, `getUser`, `deleteUser`, `listUsers`, `createAccessKey`, `listAccessKeys`, `deleteAccessKey`, `updateAccessKey`. Groups: `createGroup`, `getGroup`, `deleteGroup`, `listGroups`, `addUserToGroup`, `removeUserFromGroup`. Roles and policies: `createRole`, `getRole`, `deleteRole`, `listRoles`, `createPolicy`, `getPolicy`, `deletePolicy`, `listPolicies`, `attachUserPolicy`, `detachUserPolicy`, `listAttachedUserPolicies`, `attachGroupPolicy`, `detachGroupPolicy`, `listAttachedGroupPolicies`, `attachRolePolicy`, `detachRolePolicy`, `listAttachedRolePolicies`. Instance profiles: `createInstanceProfile`, `getInstanceProfile`, `deleteInstanceProfile`, `listInstanceProfiles`, `addRoleToInstanceProfile`, `removeRoleFromInstanceProfile`.

Message headers

header	direction	description
`CamelAwsIAMOperation`	in	Overrides `operation`.
`CamelAwsIAMUsername`	in	User.
`CamelAwsIAMGroupName`, `CamelAwsIAMGroupPath`	in	Group.
`CamelAwsIAMAccessKeyID`, `CamelAwsIAMAccessKeyStatus`	in	Access key and its new status (`Active`, `Inactive`).
`CamelAwsIAMRoleName`, `CamelAwsIAMAssumeRolePolicyDocument`	in	Role and its trust policy.
`CamelAwsIAMPolicyName`, `CamelAwsIAMPolicyDocument`, `CamelAwsIAMPolicyArn`	in	Policy (the document may also be the body).
`CamelAwsIAMInstanceProfileName`	in	Instance profile.
`CamelAwsIAMPath`, `CamelAwsIAMDescription`	in	Path and description of roles.

Run it with Docker

docker run --rm -e AWS_REGION -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/onboarding.camel.yaml

Common questions

How do I create an access key for a user?

Use operation=createAccessKey with CamelAwsIAMUsername. The body is {accessKeyId, secretAccessKey, status}: store it right away, for example in Secrets Manager, since the secret cannot be read again.

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.