aws.iam.create_role

Call AWS IAM CreateRole using a CloudConnection UUID.

Overview

Property	Value
Workflow type	Atomic
Library	Base-aws
Version	1.0

Input Schema

Field	Type	Required	Default	Description
organization_uuid	uuid	Yes	—	Authenticated organization UUID used for field resolution and connection scoping.
connection_uuid	uuid	Yes	—	AWS CloudConnection UUID for the target IAM account, scoped to the caller organization.
workflow_run_id	string	No	—	Engine DAG run ID stamped onto child steps.
region	string	No	—	AWS API endpoint region override; omit to use the connection or SDK default.
path	string	No	—	The path to the role. For more information about paths, see IAM Identifiers in the IAM User Guide. This parameter is optional. If it is not included, it defaults to a slash (/). This parameter allo...
role_name	string	Yes	—	The name of the role to create. IAM user, group, role, and policy names must be unique within the account. Names are not distinguished by case. For example, you cannot create resources named both "...
assume_role_policy_document	string	Yes	—	The trust relationship policy document that grants an entity permission to assume the role. In IAM, you must provide a JSON policy that has been converted to a string. However, for CloudFormation t...
description	string	No	—	A description of the role.
max_session_duration	integer	No	—	The maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default value of one hour is applied. This setting can hav...
permissions_boundary	string	No	—	The ARN of the managed policy that is used to set the permissions boundary for the role. A permissions boundary policy defines the maximum permissions that identity-based policies can grant to an e...
tags	list	No	—	A list of tags that you want to attach to the new role. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide....
provider_native_request	json	No	—	Optional provider-native request overrides for AWS parameters not yet promoted to first-class fields.

Output Schema

Field	Type	Required	Default	Description
organization_uuid	uuid	No	—	Organization UUID echoed from input.
connection_uuid	uuid	No	—	AWS CloudConnection UUID echoed from input.
region	string	No	—	AWS API endpoint region used.
service	string	No	—	AWS boto3 service/client name.
operation	string	No	—	AWS API operation invoked.
request_id	string	No	—	AWS request ID when available.
response	json	No	—	Sanitized provider response object.
items	list	No	—	Primary response item list when the API returns a collection.
result_count	integer	No	—	Count of primary response items.
next_page_token	string	No	—	Pagination token for the next page.
failure_reason	string	No	—	Human-readable failure reason.
failed_step	string	No	—	Failed logical step.
failed_layer	json	No	—	Failed DAG layer if engine supplies one.
failed_at_state	string	No	—	State where failure occurred.
error	string	No	—	Error message.
error_type	string	No	—	Error class.
failed_at	string	No	—	ISO failure timestamp.

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "aws.iam.create_role",
  "initial_data": {
    "organization_uuid": "value",
    "connection_uuid": "value",
    "role_name": "value",
    "assume_role_policy_document": "value"
  }
}