# AWS IAM Credential Attributes

Schema attributes for resources in the **AWS IAM Credentials** dataset.

## IAM Access Key

**Resource ID**: `aws:iam-user-access-key`

**Resource type**: `std:credential`

**Identity attribute**: `credentialId`

**Display attribute**: `accessKeyId`

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The aggregation identity, which matches `credentialId`. |
| `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{AccessKeyId}`. |
| `credentialType` | string | The credential type. Always `AWS_IAM_ACCESS_KEY`. |
| `accessKeyId` | string | The native access key ID. The connector does not collect the secret access key. |
| `ownerName` | string | The owning IAM user name. |
| `ownerArn` | string | The owning IAM user ARN. |
| `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. |
| `status` | string | The AWS status, `Active` or `Inactive`. |
| `disabled` | boolean | Whether the status is `Inactive`. |
| `createDate` | string | The creation time in ISO-8601 format. |
| `lastUsedDate` | string | The last-used date reported by AWS. Omitted when AWS has no record. |
| `lastUsedService` | string | The last-used AWS service name. The AWS `N/A` value is omitted. |
| `lastUsedRegion` | string | The last-used AWS Region. The AWS `N/A` value is omitted. |
| `displayName` | string | The credential display label. |
| `resourceUrl` | string | The IAM console security credentials link. |
| `awsAccountId` | string | AWS account ID where the credential resides. |
| `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. |
| `awsRegion` | string | AWS region where the credential resides. Always `global`. |
| `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. |

## CodeCommit HTTPS Credential

**Resource ID**: `aws:iam-codecommit-https-credential`

**Resource type**: `std:credential`

**Identity attribute**: `credentialId`

**Display attribute**: `serviceUserName`

> [!NOTE]
>
> AWS does not provide last-use or rotation field for CodeCommit HTTPS credentials. The password is not returned by the list API.

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The aggregation identity, which matches `credentialId`. |
| `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{ServiceSpecificCredentialId}`. |
| `credentialType` | string | The credential type. Always `AWS_CODECOMMIT_HTTPS_CREDENTIAL`. |
| `serviceSpecificCredentialId` | string | The native service-specific credential ID. |
| `serviceName` | string | The AWS service name. Always `codecommit.amazonaws.com`. |
| `serviceUserName` | string | The generated Git user name. |
| `ownerName` | string | The owning IAM user name. |
| `ownerArn` | string | The owning IAM user ARN. |
| `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. |
| `status` | string | The AWS status, `Active` or `Inactive`. |
| `disabled` | boolean | Whether the status is `Inactive`. |
| `createDate` | string | The creation time in ISO-8601 format. |
| `displayName` | string | The credential display label. |
| `resourceUrl` | string | The IAM console security credentials link. |
| `awsAccountId` | string | AWS account ID where the credential resides. |
| `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. |
| `awsRegion` | string | AWS region where the credential resides. Always `global`. |
| `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. |

## CodeCommit SSH Public Key

**Resource ID**: `aws:iam-codecommit-ssh-key`

**Resource type**: `std:credential`

**Identity attribute**: `credentialId`

**Display attribute**: `sshPublicKeyId`

> [!NOTE]
>
> The connector does not collect the public key body or fingerprint during aggregation.

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The aggregation identity, which matches `credentialId`. |
| `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{SSHPublicKeyId}`. |
| `credentialType` | string | The credential type. Always `AWS_CODECOMMIT_SSH_KEY`. |
| `sshPublicKeyId` | string | The native SSH public key ID. |
| `ownerName` | string | The owning IAM user name. |
| `ownerArn` | string | The owning IAM user ARN. |
| `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. |
| `status` | string | The AWS status, `Active` or `Inactive`. |
| `disabled` | boolean | Whether the status is `Inactive`. |
| `uploadDate` | string | The upload time in ISO-8601 format. |
| `displayName` | string | The credential display label. |
| `resourceUrl` | string | The IAM console security credentials link. |
| `awsAccountId` | string | AWS account ID where the credential resides. |
| `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. |
| `awsRegion` | string | AWS region where the credential resides. Always `global`. |
| `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. |

## IAM Signing Certificate

**Resource ID**: `aws:iam-signing-certificate`

**Resource type**: `std:credential`

**Identity attribute**: `credentialId`

**Display attribute**: `certificateId`

> [!NOTE]
>
> The certificate PEM body returned by the list is discarded immediately without being stored.

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | The aggregation identity, which matches `credentialId`. |
| `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{CertificateId}`. |
| `credentialType` | string | The credential type. Always `AWS_IAM_SIGNING_CERTIFICATE`. |
| `certificateId` | string | The native signing certificate ID. |
| `ownerName` | string | The owning IAM user name. |
| `ownerArn` | string | The owning IAM user ARN. |
| `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. |
| `status` | string | The AWS status, `Active` or `Inactive`. |
| `disabled` | boolean | Whether the status is `Inactive`. |
| `uploadDate` | string | The upload time in ISO-8601 format. |
| `displayName` | string | The credential display label. |
| `resourceUrl` | string | The IAM console security credentials link. |
| `awsAccountId` | string | AWS account ID where the credential resides. |
| `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. |
| `awsRegion` | string | AWS region where the credential resides. Always `global`. |
| `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. |