User and group actions

[!caution]

This service is not deployed. There is no iam.shelfcs.com or sts.shelfcs.com in the published endpoint list, and no call on this page will answer. This page is the specification, not a description of something running.

For the identity system that does exist — the identity service users, one project, one role, and EC2 access keys — read Identity, as deployed.

Objective

A user is an identity within one account — a person, or a machine. A group is a collection of users that permissions are attached to once rather than repeatedly.

Permissions

Action	Resource scope
iam:CreateUser	user/<name>
iam:GetUser, iam:ListUsers	user/*
iam:UpdateUser, iam:DeleteUser	user/<name>
iam:CreateGroup, iam:DeleteGroup	group/<name>
iam:AddUserToGroup, iam:RemoveUserFromGroup	Both user/<name> and group/<name>

AddUserToGroup evaluates against both resources. A policy naming only the group denies the call.

Instructions

CreateUser

Parameter	Type	Required	Notes
UserName	string	Yes	Unique within the account
Path	string	No	Defaults to /
Tags.member.N	list	No

PROPOSED: UserName is 1 to 64 characters, alphanumeric plus +=,.@_-. This matches what client tooling validates before calling, so a narrower rule would reject names the client believes are valid.

Response: the User — UserName, UserId, Arn, Path, CreateDate.

A new user can do nothing. It has no credentials and no policies, and every call it could make is denied until both exist. That is the intended starting state.

Errors: EntityAlreadyExists (409), InvalidInput (400), LimitExceeded (409).

GetUser

Parameter	Type	Required	Notes
UserName	string	No	Defaults to the calling identity

Called with no argument it returns the caller. That is the cheapest way for a credential to discover what it is, and it is what tooling does at startup.

ListUsers

Parameter	Type	Notes
PathPrefix	string	Restrict to a path
MaxItems	integer	Default 100, maximum 1000
Marker	string	From a previous response

Paginated with Marker and IsTruncated, not NextToken. See IAM requests and responses. Building the EC2 pagination shape here truncates the user list silently.

UpdateUser

Parameter	Type	Required
UserName	string	Yes
NewUserName	string	No
NewPath	string	No

[!warning]

Renaming a user changes its ARN, because the ARN embeds the name. Every policy that references the old ARN stops matching, silently — the request is simply denied as if no policy granted it.

This is inherited behaviour and we keep it for compatibility. Before renaming, find every policy referencing the old ARN. Attaching policies to groups rather than to users avoids the problem entirely.

DeleteUser

Parameter	Type	Required
UserName	string	Yes

Fails with DeleteConflict while the user still has access keys, attached policies, inline policies, or group memberships.

This is deliberate rather than an inconvenience. A cascading delete would silently destroy the credential something is still authenticating with, and the first anyone would know is a production outage. The caller is told what remains and removes it explicitly.

The order that works:

1. DeleteAccessKey for every key — check GetAccessKeyLastUsed first
2. DetachUserPolicy for every managed policy
3. DeleteUserPolicy for every inline policy
4. RemoveUserFromGroup for every group
5. DeleteUser

Group actions

Action	Purpose
CreateGroup	Create a group
GetGroup	The group and its members, paginated by Marker
ListGroups	Groups in the account
ListGroupsForUser	Groups one user belongs to
AddUserToGroup	Add a member
RemoveUserFromGroup	Remove a member
DeleteGroup	Delete; fails with DeleteConflict while members remain

Groups do not nest. A group cannot contain another group.

Attach policies to groups rather than to users. A user’s permissions then change by moving them between groups, which is auditable, reversible, and does not require editing a policy document under time pressure.

Go further

• Access key actions
• Policy actions
• Policies