---
id: aws-cdk-aws-iam
version: "1.204.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# aws-cdk.aws-iam — CDK routines for easily assigning correct and minimal IAM permissions

License: permissive · Maintenance: active · Downloads: 197.7K/mo

## What it is and what it does

This package is the IAM construct library for AWS CDK v1, a framework for defining cloud infrastructure using Python code. It lets you declare IAM roles, policies, users, and groups as reusable constructs and automatically generates least-privilege permission policies when you wire those constructs together with other AWS resources. For example, if you attach a Lambda function to a DynamoDB table, CDK will automatically grant the Lambda's execution role the minimum permissions needed to read or write to that table.

The package includes helpers for common patterns: attaching managed policies, importing existing IAM roles by ARN, configuring external IDs for cross-account access, and defining principals (service accounts, AWS accounts, federated identities) for assume-role policies. However, CDK v1 reached end-of-support on 2023-06-01 and is no longer receiving updates; AWS recommends migrating to CDK v2 for new projects and ongoing support.

Use it for:

- Define and attach IAM roles to Lambda functions, EC2 instances, and other AWS services in CDK v1 stacks.
- Automatically grant minimal permissions between resources (e.g., allow a Lambda to write to a DynamoDB table).
- Create inline and managed policies for users and groups in infrastructure-as-code form.
- Import and reuse existing IAM roles from your AWS account without recreating them.
- Configure cross-account role assumption with external IDs for third-party integrations.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides Python constructs for defining AWS IAM roles, policies, users, and groups within AWS CDK v1 infrastructure-as-code projects, with automatic least-privilege permission management.

No—do not install for new projects. This package is end-of-support as of 2023-06-01 and will not receive security updates or bug fixes. AWS CDK v2 is the actively maintained replacement. Install only if you are maintaining an existing CDK v1 codebase that cannot yet migrate, and plan a migration timeline.

## Install

pip install aws-cdk-aws-iam
uv add aws-cdk-aws-iam
poetry add aws-cdk-aws-iam

## Installing aws-cdk.aws-iam

Before you install: Low install friction with pure Python wheel distribution. However, the package is no longer being updated—AWS CDK v1 reached end-of-support on 2023-06-01. Users should plan migration to AWS CDK v2 for ongoing support and security updates.

License in practice: Licensed under Apache-2.0 (permissive), allowing use in commercial and open-source projects with minimal restrictions.

Quickstart:

pip install aws-cdk.aws-iam

from aws_cdk.aws_iam import Role, ServicePrincipal, PolicyStatement

role = Role(self, "MyRole",
    assumed_by=ServicePrincipal("sns.amazonaws.com")
)
role.add_to_policy(PolicyStatement(
    resources=["*"],
    actions=["lambda:InvokeFunction"]
))

Requires AWS CDK v1 core library (aws-cdk.core) and Python 3.7 or later; CDK v1 is end-of-support as of 2023-06-01.

Verify before relying:

- Whether existing CDK v1 deployments remain stable in production without active maintenance.
- Compatibility of this package with newer AWS service IAM features added after 2023-06-01.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 197.7K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aws iam role policy construct, cdk iam permissions management, aws identity access management python, infrastructure as code iam, aws cdk role definition, least privilege policy automation, iam principal grant permissions, aws-cdk, iam-management, end-of-life

[View on SkillFed](https://skillfed.io/packages/aws-cdk-aws-iam) · [View on PyPI](https://pypi.org/project/aws-cdk-aws-iam/)