= AWS Identity and Access Management (IAM) Component
:doctitle: AWS Identity and Access Management (IAM)
:shortname: aws2-iam
:artifactid: camel-aws2-iam
:description: Manage AWS IAM instances.
:since: 3.1
:supportlevel: Stable
:tabs-sync-option:
:component-header: Only producer is supported
//Manually maintained attributes
:group: AWS
:camel-spring-boot-name: aws2-iam

*Since Camel {since}*

*{component-header}*

The AWS2 IAM component supports create, run, start, stop and terminate
https://aws.amazon.com/iam/[AWS IAM] instances.

Prerequisites

You must have a valid Amazon Web Services developer account, and be
signed up to use Amazon IAM. More information is available at
https://aws.amazon.com/iam/[Amazon IAM].


== URI Format

-------------------------
aws2-iam://label[?options]
-------------------------

You can append query options to the URI in the following format:

`?options=value&option2=value&...`

[NOTE]
====
The AWS2 IAM component works on the aws-global region, and it has aws-global as the default region
====


// component options: START
include::partial$component-configure-options.adoc[]
include::partial$component-endpoint-options.adoc[]
include::partial$component-endpoint-headers.adoc[]
// component options: END


Required IAM component options

You have to provide the amazonKmsClient in the
Registry or your accessKey and secretKey to access
the https://aws.amazon.com/iam/[Amazon IAM] service.

== Usage

=== Static credentials, Default Credential Provider and Profile Credentials Provider

You have the possibility of avoiding the usage of explicit static credentials by specifying the useDefaultCredentialsProvider option and set it to true.

The order of evaluation for Default Credentials Provider is the following:

 - Java system properties - `aws.accessKeyId` and `aws.secretKey`.
 - Environment variables - `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
 - Web Identity Token from AWS STS.
 - The shared credentials and config files.
 - Amazon ECS container credentials - loaded from the Amazon ECS if the environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set.
 - Amazon EC2 Instance profile credentials. 

You have also the possibility of using Profile Credentials Provider, by specifying the useProfileCredentialsProvider option to true and profileCredentialsName to the profile name.

Only one of static, default and profile credentials could be used at the same time.

For more information about this you can look at https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials.html[AWS credentials documentation]

=== IAM Producer operations

Camel-AWS2 IAM component provides the following operation on the producer side:

- listAccessKeys
- createUser
- deleteUser
- listUsers
- getUser
- createAccessKey
- deleteAccessKey
- updateAccessKey
- createGroup
- deleteGroup
- listGroups
- addUserToGroup
- removeUserFromGroup
- createRole
- deleteRole
- getRole
- listRoles
- createPolicy
- deletePolicy
- getPolicy
- listPolicies
- attachUserPolicy
- detachUserPolicy
- attachGroupPolicy
- detachGroupPolicy
- attachRolePolicy
- detachRolePolicy
- createInstanceProfile
- deleteInstanceProfile
- getInstanceProfile
- listInstanceProfiles
- addRoleToInstanceProfile
- removeRoleFromInstanceProfile

== Examples

=== Producer Examples

- createUser: this operation will create a user in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:createUser")
    .setHeader(IAM2Constants.USERNAME, constant("camel"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createUser")
--------------------------------------------------------------------------------

- deleteUser: this operation will delete a user in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deleteUser")
    .setHeader(IAM2Constants.USERNAME, constant("camel"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=deleteUser")
--------------------------------------------------------------------------------

- listUsers: this operation will list the users in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:listUsers")
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=listUsers")
--------------------------------------------------------------------------------

- createGroup: this operation will add a group in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deleteUser")
    .setHeader(IAM2Constants.GROUP_NAME, constant("camel"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createGroup")
--------------------------------------------------------------------------------

- deleteGroup: this operation will delete a group in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deleteUser")
    .setHeader(IAM2Constants.GROUP_NAME, constant("camel"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=deleteGroup")
--------------------------------------------------------------------------------

- listGroups: this operation will list the groups in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:listUsers")
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=listGroups")
--------------------------------------------------------------------------------

==== Role Operations

- createRole: this operation will create a role in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:createRole")
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .setHeader(IAM2Constants.ASSUME_ROLE_POLICY_DOCUMENT, constant("{...}"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createRole")
--------------------------------------------------------------------------------

- deleteRole: this operation will delete a role in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deleteRole")
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=deleteRole")
--------------------------------------------------------------------------------

- getRole: this operation will get a role in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:getRole")
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=getRole")
--------------------------------------------------------------------------------

- listRoles: this operation will list the roles in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:listRoles")
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=listRoles")
--------------------------------------------------------------------------------

==== Policy Operations

- createPolicy: this operation will create a policy in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:createPolicy")
    .setHeader(IAM2Constants.POLICY_NAME, constant("myPolicy"))
    .setHeader(IAM2Constants.POLICY_DOCUMENT, constant("{...}"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createPolicy")
--------------------------------------------------------------------------------

- deletePolicy: this operation will delete a policy in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deletePolicy")
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=deletePolicy")
--------------------------------------------------------------------------------

- getPolicy: this operation will get a policy in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:getPolicy")
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=getPolicy")
--------------------------------------------------------------------------------

- listPolicies: this operation will list the policies in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:listPolicies")
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=listPolicies")
--------------------------------------------------------------------------------

==== Policy Attachment Operations

- attachUserPolicy: this operation will attach a policy to a user

[source,java]
--------------------------------------------------------------------------------
from("direct:attachUserPolicy")
    .setHeader(IAM2Constants.USERNAME, constant("camel"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=attachUserPolicy")
--------------------------------------------------------------------------------

- detachUserPolicy: this operation will detach a policy from a user

[source,java]
--------------------------------------------------------------------------------
from("direct:detachUserPolicy")
    .setHeader(IAM2Constants.USERNAME, constant("camel"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=detachUserPolicy")
--------------------------------------------------------------------------------

- attachGroupPolicy: this operation will attach a policy to a group

[source,java]
--------------------------------------------------------------------------------
from("direct:attachGroupPolicy")
    .setHeader(IAM2Constants.GROUP_NAME, constant("myGroup"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=attachGroupPolicy")
--------------------------------------------------------------------------------

- detachGroupPolicy: this operation will detach a policy from a group

[source,java]
--------------------------------------------------------------------------------
from("direct:detachGroupPolicy")
    .setHeader(IAM2Constants.GROUP_NAME, constant("myGroup"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=detachGroupPolicy")
--------------------------------------------------------------------------------

- attachRolePolicy: this operation will attach a policy to a role

[source,java]
--------------------------------------------------------------------------------
from("direct:attachRolePolicy")
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=attachRolePolicy")
--------------------------------------------------------------------------------

- detachRolePolicy: this operation will detach a policy from a role

[source,java]
--------------------------------------------------------------------------------
from("direct:detachRolePolicy")
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .setHeader(IAM2Constants.POLICY_ARN, constant("arn:aws:iam::123456789012:policy/myPolicy"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=detachRolePolicy")
--------------------------------------------------------------------------------

==== Instance Profile Operations

- createInstanceProfile: this operation will create an instance profile in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:createInstanceProfile")
    .setHeader(IAM2Constants.INSTANCE_PROFILE_NAME, constant("myInstanceProfile"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createInstanceProfile")
--------------------------------------------------------------------------------

- deleteInstanceProfile: this operation will delete an instance profile in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:deleteInstanceProfile")
    .setHeader(IAM2Constants.INSTANCE_PROFILE_NAME, constant("myInstanceProfile"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=deleteInstanceProfile")
--------------------------------------------------------------------------------

- getInstanceProfile: this operation will get an instance profile in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:getInstanceProfile")
    .setHeader(IAM2Constants.INSTANCE_PROFILE_NAME, constant("myInstanceProfile"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=getInstanceProfile")
--------------------------------------------------------------------------------

- listInstanceProfiles: this operation will list the instance profiles in IAM

[source,java]
--------------------------------------------------------------------------------
from("direct:listInstanceProfiles")
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=listInstanceProfiles")
--------------------------------------------------------------------------------

- addRoleToInstanceProfile: this operation will add a role to an instance profile

[source,java]
--------------------------------------------------------------------------------
from("direct:addRoleToInstanceProfile")
    .setHeader(IAM2Constants.INSTANCE_PROFILE_NAME, constant("myInstanceProfile"))
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=addRoleToInstanceProfile")
--------------------------------------------------------------------------------

- removeRoleFromInstanceProfile: this operation will remove a role from an instance profile

[source,java]
--------------------------------------------------------------------------------
from("direct:removeRoleFromInstanceProfile")
    .setHeader(IAM2Constants.INSTANCE_PROFILE_NAME, constant("myInstanceProfile"))
    .setHeader(IAM2Constants.ROLE_NAME, constant("myRole"))
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=removeRoleFromInstanceProfile")
--------------------------------------------------------------------------------

=== Using a POJO as body

Sometimes building an AWS Request can be complex because of multiple options. We introduce the possibility to use a POJO as a body.
In AWS IAM, there are multiple operations you can submit, as an example for Create User request, you can do something like:

[source,java]
------------------------------------------------------------------------------------------------------
from("direct:createUser")
     .setBody(CreateUserRequest.builder().userName("camel").build())
    .to("aws2-iam://test?iamClient=#amazonIAMClient&operation=createUser&pojoRequest=true")
------------------------------------------------------------------------------------------------------

In this way, you'll pass the request directly without the need of passing headers and options specifically related to this operation.

== Dependencies

Maven users will need to add the following dependency to their pom.xml.

*pom.xml*

[source,xml]
---------------------------------------
<dependency>
    <groupId>org.apache.camel</groupId>
    <artifactId>camel-aws2-iam</artifactId>
    <version>${camel-version}</version>
</dependency>
---------------------------------------

where `$\{camel-version}` must be replaced by the actual version of Camel.


include::spring-boot:partial$starter.adoc[]
