IAM API

TinyS3 implements the AWS IAM query API on the same endpoint as S3, plus the STS AssumeRole and GetCallerIdentity actions. Identities are persisted (.tinys3-iam.json under the storage path) and enforced on every S3 request — a user only sees and touches what their attached policies allow.

Point any IAM client at the server:

aws iam create-user --user-name alice --endpoint-url http://localhost:8000
aws iam create-access-key --user-name alice --endpoint-url http://localhost:8000
aws iam attach-user-policy --user-name alice \
  --policy-arn arn:aws:iam::<account>:policy/S3ReadAccess \
  --endpoint-url http://localhost:8000

Supported operations

Users — Create/Get/Update/DeleteUser, ListUsers, ListGroupsForUser

Access keys — Create/Delete/UpdateAccessKey (activate/deactivate), ListAccessKeys

Groups — Create/Get/Update/DeleteGroup, ListGroups, AddUserToGroup, RemoveUserFromGroup

Roles — Create/Get/Update/DeleteRole, ListRoles, UpdateAssumeRolePolicy

Managed policies — Create/Get/DeletePolicy, ListPolicies (built-in + customer scope), Create/Get/Delete/ListPolicyVersions, SetDefaultPolicyVersion (5-version cap, like AWS)

Policy attachment — Attach/Detach for users, groups and roles; ListAttached*Policies

Inline policies — Put/Get/Delete*Policy and List*Policies for users, groups and roles

Account — GetAccountSummary, ListOpenIDConnectProviders (returns empty), GetCallerIdentity (STS)

STS — AssumeRole (evaluates the role's sts:AssumeRole trust policy and issues temporary session credentials), GetCallerIdentity

Built-in managed policies

The server publishes AWS-style managed policies out of the box — AdministratorAccess, AmazonS3FullAccess, AmazonS3ReadOnlyAccess, plus granular S3*Access, S3Bucket*Access, S3Object*Access and IAM*Access families. They cannot be modified or deleted.

Policy evaluation

Bucket and identity policies support conditions including s3:prefix, request/resource tags, ACL and encryption headers, and copy-source constraints. Explicit deny wins; the account root always has access.

Not implemented

Cross-account principals, OIDC federation (identity providers are listed but not used for federation), login profiles (passwords), MFA, and IAM tags. STS beyond AssumeRole / GetCallerIdentity (e.g. AssumeRoleWithWebIdentity, GetSessionToken) is not implemented.