# Role


<style>
  span[class^="pill-"] {
    color: white;
    padding: 2px 12px;
    border-radius: 12px;
    font-size: 0.6em;
    vertical-align: middle;
    margin-right: 12px;
    font-family: sans-serif;
    font-weight: bold;
    display: inline-block;
    line-height: 1;
  }
  span.pill-GET { background-color: #61affe; }
  span.pill-POST { background-color: #49cc90; }
  span.pill-PUT { background-color: #fca130; }
  span.pill-DELETE { background-color: #f93e3e; }
  span.pill-PATCH { background-color: #50e3c2; }
  span[class^="pill-"]:after {
    content: attr(data-label);
    font-size: 0.9rem;
  }
</style>

IAM roles lets you define logical sets of policies to grant to users and API keys.

[Read more](https://community.exoscale.com/product/iam/operation/role-mgmt/)

## <span data-label="POST" class="pill-POST"></span>create-iam-role

Create IAM Role

```
POST /iam-role
```

### Request body

Content-Type: `application/json`

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | **yes** | IAM Role name<br/><br/>Min length: `1`. Max length: `191`. |
| `assume-role-policy` | [Assume Role Policy](/reference/api/_schemas/iam-assume-role-policy/) | no | IAM Assume role policy |
| `description` | string | no | IAM Role description<br/><br/>Min length: `1`. Max length: `255`. |
| `editable` | boolean | no | Sets if the IAM Role Policy is editable or not (default: true). This setting cannot be changed after creation |
| `labels` | object | no | IAM Role labels |
| `max-session-ttl` | integer | no | Maximum TTL requester is allowed to ask for when assuming a role<br/><br/>Min: `0`. |
| `permissions` | array[string] | no | IAM Role permissions |
| `policy` | [Policy](/reference/api/_schemas/iam-policy/) | no | IAM Role policy |

<details>
<summary>Example</summary>

```json
{
  "assume-role-policy": {
    "rules": [
      {
        "action": "allow",
        "expression": "string",
        "resources": [
          "string"
        ]
      }
    ]
  },
  "description": "string",
  "editable": true,
  "labels": {},
  "max-session-ttl": 0,
  "name": "string",
  "permissions": [
    "bypass-governance-retention"
  ],
  "policy": {
    "default-service-strategy": "allow",
    "services": {}
  }
}
```
</details>


### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `id` | string | Operation ID<br/><br/>Must be a valid UUID. |
| `message` | string | Operation message |
| `reason` | string | Operation failure reason<br/><br/>Allowed values: `incorrect`, `unknown`, `unavailable`, `forbidden`, `busy`, `fault`, `partial`, `not-found`, `interrupted`, `unsupported`, `conflict`. |
| `reference` | [Reference](/reference/api/_schemas/operation/#reference) | Related resource reference |
| `state` | string | Operation status<br/><br/>Allowed values: `failure`, `pending`, `success`, `timeout`. |

<details>
<summary>Example output</summary>

```json
{
  "id": "string",
  "message": "string",
  "reason": "incorrect",
  "reference": {
    "command": "string",
    "id": "string",
    "link": "string"
  },
  "state": "failure"
}
```
</details>


SDK reference for `create-iam-role`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.CreateIAMRole) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.create_iam_role) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#createIamRole(com.exoscale.sdk.model.CreateIamRoleRequest))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api create-iam-role`

## <span data-label="GET" class="pill-GET"></span>get-iam-role

Retrieve IAM Role

```
GET /iam-role/{id}
```

### Path parameters

| Name | In | Description |
| --- | --- | --- |
| `id` | `path` | Must be a valid UUID. |

### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `assume-role-policy` | [Assume Role Policy](/reference/api/_schemas/iam-assume-role-policy/) | IAM Assume Role Policy |
| `description` | string | IAM Role description<br/><br/>Min length: `1`. Max length: `255`. |
| `editable` | boolean | IAM Role mutability |
| `id` | string | IAM Role ID<br/><br/>Must be a valid UUID. |
| `labels` | object | IAM Role Labels |
| `max-session-ttl` | integer | Maximum TTL requester is allowed to ask for when assuming a role<br/><br/>Min: `0`. |
| `name` | string | IAM Role name<br/><br/>Min length: `1`. Max length: `255`. |
| `permissions` | array[string] | IAM Role permissions |
| `policy` | [Policy](/reference/api/_schemas/iam-policy/) | IAM Role Policy |

<details>
<summary>Example output</summary>

```json
{
  "assume-role-policy": {
    "rules": [
      {
        "action": "allow",
        "expression": "string",
        "resources": [
          "string"
        ]
      }
    ]
  },
  "description": "string",
  "editable": true,
  "id": "string",
  "labels": {},
  "max-session-ttl": 0,
  "name": "string",
  "permissions": [
    "bypass-governance-retention"
  ],
  "policy": {
    "default-service-strategy": "allow",
    "services": {}
  }
}
```
</details>


SDK reference for `get-iam-role`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.GetIAMRole) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.get_iam_role) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#getIamRole(java.util.UUID))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api get-iam-role`

## <span data-label="PUT" class="pill-PUT"></span>update-iam-role

Update IAM Role

```
PUT /iam-role/{id}
```

### Path parameters

| Name | In | Description |
| --- | --- | --- |
| `id` | `path` | Must be a valid UUID. |

### Request body

Content-Type: `application/json`

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `assume-role-policy` | [Assume Role Policy](/reference/api/_schemas/iam-assume-role-policy/) | no | IAM Assume role policy |
| `description` | string | no | IAM Role description<br/><br/>Min length: `1`. Max length: `255`. |
| `labels` | object | no | IAM Role labels |
| `max-session-ttl` | integer | no | Maximum TTL requester is allowed to ask for when assuming a role<br/><br/>Min: `0`. |
| `permissions` | array[string] | no | IAM Role permissions |

<details>
<summary>Example</summary>

```json
{
  "assume-role-policy": {
    "rules": [
      {
        "action": "allow",
        "expression": "string",
        "resources": [
          "string"
        ]
      }
    ]
  },
  "description": "string",
  "labels": {},
  "max-session-ttl": 0,
  "permissions": [
    "bypass-governance-retention"
  ]
}
```
</details>


### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `id` | string | Operation ID<br/><br/>Must be a valid UUID. |
| `message` | string | Operation message |
| `reason` | string | Operation failure reason<br/><br/>Allowed values: `incorrect`, `unknown`, `unavailable`, `forbidden`, `busy`, `fault`, `partial`, `not-found`, `interrupted`, `unsupported`, `conflict`. |
| `reference` | [Reference](/reference/api/_schemas/operation/#reference) | Related resource reference |
| `state` | string | Operation status<br/><br/>Allowed values: `failure`, `pending`, `success`, `timeout`. |

<details>
<summary>Example output</summary>

```json
{
  "id": "string",
  "message": "string",
  "reason": "incorrect",
  "reference": {
    "command": "string",
    "id": "string",
    "link": "string"
  },
  "state": "failure"
}
```
</details>


SDK reference for `update-iam-role`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.UpdateIAMRole) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.update_iam_role) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#updateIamRole(java.util.UUID,com.exoscale.sdk.model.UpdateIamRoleRequest))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api update-iam-role`

## <span data-label="DELETE" class="pill-DELETE"></span>delete-iam-role

Delete IAM Role

```
DELETE /iam-role/{id}
```

### Path parameters

| Name | In | Description |
| --- | --- | --- |
| `id` | `path` | Must be a valid UUID. |

### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `id` | string | Operation ID<br/><br/>Must be a valid UUID. |
| `message` | string | Operation message |
| `reason` | string | Operation failure reason<br/><br/>Allowed values: `incorrect`, `unknown`, `unavailable`, `forbidden`, `busy`, `fault`, `partial`, `not-found`, `interrupted`, `unsupported`, `conflict`. |
| `reference` | [Reference](/reference/api/_schemas/operation/#reference) | Related resource reference |
| `state` | string | Operation status<br/><br/>Allowed values: `failure`, `pending`, `success`, `timeout`. |

<details>
<summary>Example output</summary>

```json
{
  "id": "string",
  "message": "string",
  "reason": "incorrect",
  "reference": {
    "command": "string",
    "id": "string",
    "link": "string"
  },
  "state": "failure"
}
```
</details>


SDK reference for `delete-iam-role`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.DeleteIAMRole) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.delete_iam_role) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#deleteIamRole(java.util.UUID))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api delete-iam-role`


---

## Other Operations

## <span data-label="POST" class="pill-POST"></span>assume-iam-role

[BETA] Request generation of key/secret that allow caller to assume target role

```
POST /iam-role/{id}/assume
```

[BETA] Request generation of key/secret that allow caller to assume target role

### Path parameters

| Name | In | Description |
| --- | --- | --- |
| `id` | `path` | Must be a valid UUID. |

### Request body

Content-Type: `application/json`

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `ttl` | integer | **yes** | TTL in seconds for the generated access key (cannot exceed the max TTL defined in the targeted assume role)<br/><br/>Min: `0`. |

<details>
<summary>Example</summary>

```json
{
  "ttl": 0
}
```
</details>


### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `expires-at` | string |  |
| `key` | string |  |
| `name` | string |  |
| `org-id` | string |  |
| `role-id` | string |  |
| `secret` | string |  |

<details>
<summary>Example output</summary>

```json
{
  "expires-at": "string",
  "key": "string",
  "name": "string",
  "org-id": "string",
  "role-id": "string",
  "secret": "string"
}
```
</details>


SDK reference for `assume-iam-role`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.AssumeIAMRole) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.assume_iam_role) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#assumeIamRole(java.util.UUID,com.exoscale.sdk.model.AssumeIamRoleRequest))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api assume-iam-role`

## <span data-label="PUT" class="pill-PUT"></span>update-iam-role-policy

Update IAM Role Policy

```
PUT /iam-role/{id}:policy
```

### Path parameters

| Name | In | Description |
| --- | --- | --- |
| `id` | `path` | Must be a valid UUID. |

### Request body

Content-Type: `application/json`

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `default-service-strategy` | string | **yes** | IAM default service strategy<br/><br/>Allowed values: `allow`, `deny`. |
| `services` | object | **yes** | IAM services |

<details>
<summary>Example</summary>

```json
{
  "default-service-strategy": "allow",
  "services": {}
}
```
</details>


### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `id` | string | Operation ID<br/><br/>Must be a valid UUID. |
| `message` | string | Operation message |
| `reason` | string | Operation failure reason<br/><br/>Allowed values: `incorrect`, `unknown`, `unavailable`, `forbidden`, `busy`, `fault`, `partial`, `not-found`, `interrupted`, `unsupported`, `conflict`. |
| `reference` | [Reference](/reference/api/_schemas/operation/#reference) | Related resource reference |
| `state` | string | Operation status<br/><br/>Allowed values: `failure`, `pending`, `success`, `timeout`. |

<details>
<summary>Example output</summary>

```json
{
  "id": "string",
  "message": "string",
  "reason": "incorrect",
  "reference": {
    "command": "string",
    "id": "string",
    "link": "string"
  },
  "state": "failure"
}
```
</details>


SDK reference for `update-iam-role-policy`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.UpdateIAMRolePolicy) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.update_iam_role_policy) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#updateIamRolePolicy(java.util.UUID,com.exoscale.sdk.model.UpdateIamRolePolicyRequest))

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api update-iam-role-policy`

## <span data-label="GET" class="pill-GET"></span>list-iam-roles

List IAM Roles

```
GET /iam-role
```

### Responses

Status: `200` - 200

Content-Type: `application/json`

| Property | Type | Description |
| --- | --- | --- |
| `iam-roles` | array of [IAM Role](/reference/api/_schemas/iam-role/) |  |

<details>
<summary>Example output</summary>

```json
{
  "iam-roles": [
    {
      "assume-role-policy": {
        "rules": [
          {
            "action": null,
            "expression": null,
            "resources": null
          }
        ]
      },
      "description": "string",
      "editable": true,
      "id": "string",
      "labels": {},
      "max-session-ttl": 0,
      "name": "string",
      "permissions": [
        "bypass-governance-retention"
      ],
      "policy": {
        "default-service-strategy": "allow",
        "services": {}
      }
    }
  ]
}
```
</details>


SDK reference for `list-iam-roles`: [golang](https://pkg.go.dev/github.com/exoscale/egoscale/v3#Client.ListIAMRoles) | [Python](https://exoscale.github.io/python-exoscale/v2.html#exoscale.api.v2.Client.list_iam_roles) | [Java](https://exoscale.github.io/exoscale-sdk-java/com/exoscale/sdk/api/ExoscaleApi.html#listIamRoles())

[CLI](https://community.exoscale.com/tools/command-line-interface/): `exo api list-iam-roles`