New List Resource: aws_iam_user

[jar-b]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

Adds a new list resource for aws_iam_user. Also introduces resource identity in order to support list. Because the provider currently allows the name and path to be modified in place, the identity will be considered mutable.

Output from Acceptance Testing

% make t K=iam T=TestAccIAMUser_
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 f-iam_user-list 🌿...
TF_ACC=1 go1.25.8 test ./internal/service/iam/... -v -count 1 -parallel 20 -run='TestAccIAMUser_'  -timeout 360m -vet=off
2026/03/10 16:59:25 Creating Terraform AWS Provider (SDKv2-style)...
2026/03/10 16:59:25 Initializing Terraform AWS Provider (SDKv2-style)...

--- PASS: TestAccIAMUser_ForceDestroy_policyInlineAttached (37.44s)
=== CONT  TestAccIAMUser_Tags_DefaultTags_nullOverlappingResourceTag
--- PASS: TestAccIAMUser_ForceDestroy_policyInline (38.11s)
=== CONT  TestAccIAMUser_Tags_addOnUpdate
--- PASS: TestAccIAMUser_ForceDestroy_policyAttached (40.43s)
=== CONT  TestAccIAMUser_Tags_EmptyTag_onCreate
--- PASS: TestAccIAMUser_ForceDestroy_serviceSpecificCred (48.37s)
=== CONT  TestAccIAMUser_List_basic
--- PASS: TestAccIAMUser_ForceDestroy_sshKey (49.97s)
=== CONT  TestAccIAMUser_List_pathPrefix
--- PASS: TestAccIAMUser_ForceDestroy_signingCertificate (50.13s)
=== CONT  TestAccIAMUser_List_includeResource
--- PASS: TestAccIAMUser_Tags_DefaultTags_nullNonOverlappingResourceTag (52.72s)
=== CONT  TestAccIAMUser_Identity_ExistingResource_noRefreshNoChange
--- PASS: TestAccIAMUser_Tags_DefaultTags_emptyProviderOnlyTag (52.79s)
=== CONT  TestAccIAMUser_Tags_EmptyTag_OnUpdate_replace
--- PASS: TestAccIAMUser_pathChange (70.56s)
=== CONT  TestAccIAMUser_Tags_DefaultTags_overlapping
--- PASS: TestAccIAMUser_basic (74.38s)
=== CONT  TestAccIAMUser_ForceDestroy_loginProfile
--- PASS: TestAccIAMUser_nameChange (74.60s)
=== CONT  TestAccIAMUser_ForceDestroy_mfaDevice
--- PASS: TestAccIAMUser_nameAndTags (78.83s)
=== CONT  TestAccIAMUser_Tags_emptyMap
--- PASS: TestAccIAMUser_Identity_basic (80.27s)
=== CONT  TestAccIAMUser_ForceDestroy_accessKey
--- PASS: TestAccIAMUser_List_basic (41.29s)
=== CONT  TestAccIAMUser_Identity_ExistingResource_basic
--- PASS: TestAccIAMUser_List_pathPrefix (39.78s)
=== CONT  TestAccIAMUser_Tags_DefaultTags_emptyResourceTag
--- PASS: TestAccIAMUser_Tags_ComputedTag_OnUpdate_replace (89.84s)
=== CONT  TestAccIAMUser_Tags_IgnoreTags_Overlap_resourceTag
--- PASS: TestAccIAMUser_Tags_DefaultTags_updateToProviderOnly (93.33s)
=== CONT  TestAccIAMUser_Tags_IgnoreTags_Overlap_defaultTag
--- PASS: TestAccIAMUser_List_includeResource (43.50s)
=== CONT  TestAccIAMUser_Tags_DefaultTags_updateToResourceOnly
--- PASS: TestAccIAMUser_Tags_DefaultTags_nullOverlappingResourceTag (56.25s)
=== CONT  TestAccIAMUser_Tags_null
--- PASS: TestAccIAMUser_ForceDestroy_loginProfile (48.24s)
=== CONT  TestAccIAMUser_Tags_ComputedTag_OnUpdate_add
--- PASS: TestAccIAMUser_ForceDestroy_mfaDevice (48.13s)
=== CONT  TestAccIAMUser_disappears
--- PASS: TestAccIAMUser_Tags_addOnUpdate (88.04s)
=== CONT  TestAccIAMUser_Tags_ComputedTag_onCreate
--- PASS: TestAccIAMUser_ForceDestroy_accessKey (46.02s)
--- PASS: TestAccIAMUser_Tags_EmptyTag_OnUpdate_add (129.04s)
--- PASS: TestAccIAMUser_Identity_ExistingResource_noRefreshNoChange (83.11s)
--- PASS: TestAccIAMUser_Tags_DefaultTags_nonOverlapping (137.36s)
--- PASS: TestAccIAMUser_Tags_EmptyTag_OnUpdate_replace (85.10s)
--- PASS: TestAccIAMUser_Tags_DefaultTags_emptyResourceTag (51.48s)
--- PASS: TestAccIAMUser_Tags_EmptyTag_onCreate (101.00s)
--- PASS: TestAccIAMUser_Tags_emptyMap (72.41s)
--- PASS: TestAccIAMUser_disappears (29.67s)
--- PASS: TestAccIAMUser_Tags_null (62.64s)
--- PASS: TestAccIAMUser_Identity_ExistingResource_basic (68.49s)
--- PASS: TestAccIAMUser_Tags_DefaultTags_updateToResourceOnly (67.80s)
--- PASS: TestAccIAMUser_Tags_ComputedTag_onCreate (35.76s)
--- PASS: TestAccIAMUser_tags (163.88s)
--- PASS: TestAccIAMUser_Tags_DefaultTags_providerOnly (166.94s)
--- PASS: TestAccIAMUser_permissionsBoundary (169.05s)
--- PASS: TestAccIAMUser_Tags_IgnoreTags_Overlap_defaultTag (77.29s)
--- PASS: TestAccIAMUser_Tags_ComputedTag_OnUpdate_add (49.49s)
--- PASS: TestAccIAMUser_Tags_DefaultTags_overlapping (102.18s)
--- PASS: TestAccIAMUser_Tags_IgnoreTags_Overlap_resourceTag (84.36s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/iam        181.107s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[jar-b]

Identity is mutable because the provider allows name and path can be modified in place.

Perhaps this is something we reconsider in a future major version, but for now I'm not sure we can avoid marking it this way without breaking existing behavior.

[gdavison]

The AWS API also allows changing the name and path in-place.

Technically, the UserId (exposed as unique_id in the provider) is the stable unique identifier, but it's not exposed to the user, so not useful for import.

Alternatively, we could use unique_id as the Identifier, but the GetUser and ListUsers API calls aren't documented to accept the value, just the name. This would require a "full table scan" for reading IAM Users.

[gdavison]

Missing some attributes from the includeResource test. Otherwise, looks good.

[gdavison]

The AWS API also allows changing the name and path in-place.

Technically, the UserId (exposed as unique_id in the provider) is the stable unique identifier, but it's not exposed to the user, so not useful for import.

Alternatively, we could use unique_id as the Identifier, but the GetUser and ListUsers API calls aren't documented to accept the value, just the name. This would require a "full table scan" for reading IAM Users.

[gdavison]

Looks good! 🚀

[gdavison]

Looks good! 🚀

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.