AWS IAM Credential Attributes

Schema attributes for resources in the AWS IAM Credentials dataset.

IAM Access Key

Resource ID: aws:iam-user-access-key

Resource type: std:credential

Identity attribute: credentialId

Display attribute: accessKeyId

Attribute	Type	Description
`identity`	string	The aggregation identity, which matches `credentialId`.
`credentialId`	string	The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{AccessKeyId}`.
`credentialType`	string	The credential type. Always `AWS_IAM_ACCESS_KEY`.
`accessKeyId`	string	The native access key ID. The connector does not collect the secret access key.
`ownerName`	string	The owning IAM user name.
`ownerArn`	string	The owning IAM user ARN.
`ownerPrincipalType`	string	The owner principal type. Always `IAM_USER`.
`status`	string	The AWS status, `Active` or `Inactive`.
`disabled`	boolean	Whether the status is `Inactive`.
`createDate`	string	The creation time in ISO-8601 format.
`lastUsedDate`	string	The last-used date reported by AWS. Omitted when AWS has no record.
`lastUsedService`	string	The last-used AWS service name. The AWS `N/A` value is omitted.
`lastUsedRegion`	string	The last-used AWS Region. The AWS `N/A` value is omitted.
`displayName`	string	The credential display label.
`resourceUrl`	string	The IAM console security credentials link.
`awsAccountId`	string	AWS account ID where the credential resides.
`awsPartition`	string	The AWS partition, such as `aws` or `aws-us-gov`.
`awsRegion`	string	AWS region where the credential resides. Always `global`.
`spBusinessApplication`	string	SailPoint business application for the credential. Always `AWS IAM`.

CodeCommit HTTPS Credential

Resource ID: aws:iam-codecommit-https-credential

Resource type: std:credential

Identity attribute: credentialId

Display attribute: serviceUserName

Note

AWS does not provide last-use or rotation field for CodeCommit HTTPS credentials. The password is not returned by the list API.

Attribute	Type	Description
`identity`	string	The aggregation identity, which matches `credentialId`.
`credentialId`	string	The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{ServiceSpecificCredentialId}`.
`credentialType`	string	The credential type. Always `AWS_CODECOMMIT_HTTPS_CREDENTIAL`.
`serviceSpecificCredentialId`	string	The native service-specific credential ID.
`serviceName`	string	The AWS service name. Always `codecommit.amazonaws.com`.
`serviceUserName`	string	The generated Git user name.
`ownerName`	string	The owning IAM user name.
`ownerArn`	string	The owning IAM user ARN.
`ownerPrincipalType`	string	The owner principal type. Always `IAM_USER`.
`status`	string	The AWS status, `Active` or `Inactive`.
`disabled`	boolean	Whether the status is `Inactive`.
`createDate`	string	The creation time in ISO-8601 format.
`displayName`	string	The credential display label.
`resourceUrl`	string	The IAM console security credentials link.
`awsAccountId`	string	AWS account ID where the credential resides.
`awsPartition`	string	The AWS partition, such as `aws` or `aws-us-gov`.
`awsRegion`	string	AWS region where the credential resides. Always `global`.
`spBusinessApplication`	string	SailPoint business application for the credential. Always `AWS IAM`.

CodeCommit SSH Public Key

Resource ID: aws:iam-codecommit-ssh-key

Resource type: std:credential

Identity attribute: credentialId

Display attribute: sshPublicKeyId

Note

The connector does not collect the public key body or fingerprint during aggregation.

Attribute	Type	Description
`identity`	string	The aggregation identity, which matches `credentialId`.
`credentialId`	string	The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{SSHPublicKeyId}`.
`credentialType`	string	The credential type. Always `AWS_CODECOMMIT_SSH_KEY`.
`sshPublicKeyId`	string	The native SSH public key ID.
`ownerName`	string	The owning IAM user name.
`ownerArn`	string	The owning IAM user ARN.
`ownerPrincipalType`	string	The owner principal type. Always `IAM_USER`.
`status`	string	The AWS status, `Active` or `Inactive`.
`disabled`	boolean	Whether the status is `Inactive`.
`uploadDate`	string	The upload time in ISO-8601 format.
`displayName`	string	The credential display label.
`resourceUrl`	string	The IAM console security credentials link.
`awsAccountId`	string	AWS account ID where the credential resides.
`awsPartition`	string	The AWS partition, such as `aws` or `aws-us-gov`.
`awsRegion`	string	AWS region where the credential resides. Always `global`.
`spBusinessApplication`	string	SailPoint business application for the credential. Always `AWS IAM`.

IAM Signing Certificate

Resource ID: aws:iam-signing-certificate

Resource type: std:credential

Identity attribute: credentialId

Display attribute: certificateId

Note

The certificate PEM body returned by the list is discarded immediately without being stored.

Attribute	Type	Description
`identity`	string	The aggregation identity, which matches `credentialId`.
`credentialId`	string	The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{CertificateId}`.
`credentialType`	string	The credential type. Always `AWS_IAM_SIGNING_CERTIFICATE`.
`certificateId`	string	The native signing certificate ID.
`ownerName`	string	The owning IAM user name.
`ownerArn`	string	The owning IAM user ARN.
`ownerPrincipalType`	string	The owner principal type. Always `IAM_USER`.
`status`	string	The AWS status, `Active` or `Inactive`.
`disabled`	boolean	Whether the status is `Inactive`.
`uploadDate`	string	The upload time in ISO-8601 format.
`displayName`	string	The credential display label.
`resourceUrl`	string	The IAM console security credentials link.
`awsAccountId`	string	AWS account ID where the credential resides.
`awsPartition`	string	The AWS partition, such as `aws` or `aws-us-gov`.
`awsRegion`	string	AWS region where the credential resides. Always `global`.
`spBusinessApplication`	string	SailPoint business application for the credential. Always `AWS IAM`.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.