AWS IAM

Create local IAM users, groups, roles and group memberships, and read them back.

Plan: Free169 of 180 operations implemented, 3 failed in testing75Known differences

Generated report IDs are rejected by the requests that read them, the account summary is empty, policy simulation is partial, and enforcement is off by default.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

This Free service needs no license key. Start Vera as in Get started, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The emulator serves IAM’s 2010-05-08 API over the AWS Query protocol, through the AWS CLI’s iam commands. IAM is in the Free plan.

Example

Create a user and a group, add the user to the group, and list the group’s members:

aws --endpoint-url "$VERA_ENDPOINT" iam create-user --user-name docs-user
aws --endpoint-url "$VERA_ENDPOINT" iam create-group --group-name docs-group
aws --endpoint-url "$VERA_ENDPOINT" iam add-user-to-group --user-name docs-user --group-name docs-group
aws --endpoint-url "$VERA_ENDPOINT" iam get-group --group-name docs-group --query 'Users[].UserName'

The last command lists the group’s members by user name. The new user is the only one:

[
    "docs-user"
]

To clean up, remove the user from the group, then delete the group and the user:

aws --endpoint-url "$VERA_ENDPOINT" iam remove-user-from-group --user-name docs-user --group-name docs-group
aws --endpoint-url "$VERA_ENDPOINT" iam delete-group --group-name docs-group
aws --endpoint-url "$VERA_ENDPOINT" iam delete-user --user-name docs-user

The user and the group are local records. Policies attached to them aren’t shown to be enforced: see Limitations.

Supported features

In Vera 1.2.2, on 8 November 2026, these worked on a full-access license:

Users and groups: created, read, listed and deleted, with a user added to a group and removed, as in the example.
Roles: created, read, listed and deleted. Roles created this way worked with STS and in the role settings of other services, such as Lambda and Step Functions. A service accepting a role doesn’t mean the role’s permissions are enforced, or that the service runs what it’s given: see each service’s page.

In Vera 1.2.0 preview, creating, reading, listing and deleting users, groups and roles answered HTTP 500 InternalFailure, and in Vera 1.2.0-rc.3, ListUsers still did. Report, summary and policy simulation requests were also checked on Vera 1.2.2, and have the limits below.

The other operations weren’t run on Vera 1.2.2. The API coverage marks them from a review of the Vera 1.2.0 source, on 6 November 2026, or from earlier testing. Source findings describe local implementations and their limits, not successful runs of a release build.

Earlier checks, on 3 November 2026, also recorded:

Users and groups created with tags, read and deleted, and members added to and removed from groups.
Roles created with a trust policy, then assumed through STS.
Role policies: putting, reading, listing and deleting inline policies, attaching, detaching and listing managed ones, creating and deleting policy versions, deleting policies and listing what a policy is attached to. These matched recorded AWS responses, several of them on empty responses only.

The earlier implementation inventory also listed access keys, login profiles and passwords, MFA devices, instance profiles, OpenID Connect and SAML providers, server and signing certificates, SSH keys, permissions boundaries, account settings and reports, tags and SimulatePrincipalPolicy. Apart from the reports and the account summary, none of them was checked in Vera 1.2.2, or run successfully in Vera 1.2.0 preview or Vera 1.2.0-rc.3. The API coverage marks them from the review of the Vera 1.2.0 source, with their limits in the notes, and the ones you’re most likely to hit are below.

Limitations

The main limits are below. Those found by the review of the Vera 1.2.0 source describe its implementation, not runs of a release build. A few more apply to every service, and the API coverage notes cover smaller differences.

Generated reports can’t be read back. In Vera 1.2.2, GenerateServiceLastAccessedDetails and GenerateOrganizationsAccessReport return 24-character job IDs, but the requests that read the reports, GetServiceLastAccessedDetails, GetServiceLastAccessedDetailsWithEntities and GetOrganizationsAccessReport, need IDs of at least 36 characters. SDK clients reject the generated IDs, and a direct Query request answers HTTP 400 ValidationError. In the source, the generators store no job and examine no access, and the readers return a completed, empty report for any well-formed job ID.
The account summary is empty. In Vera 1.2.2, GetAccountSummary answers HTTP 200 with an empty SummaryMap, even with a user, a group and a role present.
Some status requests report completion without content. In Vera 1.2.2, GetHumanReadableSummary answered HTTP 200 with COMPLETED but no summary, even for an entity that doesn’t exist. GetServiceLinkedRoleDeletionStatus reported SUCCEEDED for a tested deletion, but in the source it returns SUCCEEDED for any task ID, without tracking the deletion.
Only simple policy simulation was shown to work. In Vera 1.2.2, SimulateCustomPolicy returned allowed for a simple Allow policy. Beyond that, evaluation is partial. In the source, SimulatePrincipalPolicy and SimulateCustomPolicy evaluate only the first resource ARN, and ignore context entries, permissions boundaries and resource policies. SimulatePrincipalPolicy does collect the principal’s inline, attached and group policies. Policy conditions are evaluated only for StringEquals, and any other operator counts as satisfied: in a test against the source, a Bool condition requiring secure transport still allowed a context where secure transport was false.
Identity-based policy enforcement is off by default. Even when it’s turned on, the caller is identified from the access key ID without verifying the request’s signature, and permissions boundaries aren’t applied. Resource policies and STS session checks are separate and can apply on their own. Full AWS authorization behavior wasn’t established.
Some operations are missing or return empty results. AcquireRole, GetRoleTemplateVersion and PutAccountProperties aren’t implemented, and in Vera 1.2.0-rc.3 they answered HTTP 400 InvalidAction. GetAccountProperties always returns an empty map. In the source, ChangePassword and ResyncMFADevice succeed without changing anything, SetSecurityTokenServicePreferences doesn’t affect STS tokens, and ListPoliciesGrantingServiceAccess returns no policies.
Some writes and reads lose data. In test requests against the source, DeleteSigningCertificate returned NoSuchEntity for an uploaded certificate and left it in place, and UpdateLoginProfile with only PasswordResetRequired removed the password, so the login profile then read as missing. UpdateRole reset the maximum session duration or the description when a request left it out, renaming a user with UpdateUser lost its tags, and GetAccountAuthorizationDetails came back empty with users, roles and an attached policy present.
Some lists ignore filters or pagination. Many lists page with Marker and MaxItems, but ListInstanceProfiles ignores PathPrefix and pagination, and ListUserPolicies, ListMFADevices, ListServerCertificates, several tag lists and the delegation and service-specific credential lists ignore pagination. ListEntitiesForPolicy honors only EntityFilter, and ListPolicies ignores PolicyUsageFilter.
Some features keep local records only. Delegation requests, Organizations root features, outbound web identity federation and service-specific credentials store records and flags locally. No permission is delegated and no token is sent. No root credentials, sessions or JWT issuer sit behind the flags, and the credentials aren’t shown to work with any service.
Passwords and MFA codes aren’t checked. The account password policy is stored but not enforced, and CreateLoginProfile ignores PasswordResetRequired. Enabling an MFA device accepts any codes, without TOTP validation, and a virtual device’s QRCodePNG is random bytes, not an image. Deleting an assigned virtual device leaves the user associated with it.
Failed writes weren’t reliably rolled back. In Vera 1.2.0 preview, a create that answered 500 could still leave a record, so retrying a failed write wasn’t harmless. Don’t build other examples on records that failed requests left behind.
Earlier response differences. On 3 November 2026, CreateRole and CreatePolicy returned fields such as Description and Tags differently from AWS, ListPolicyVersions included each version’s Document, and SimulateCustomPolicy differed in its evaluation details. These fields weren’t compared again in Vera 1.2.0 preview, Vera 1.2.0-rc.3 or Vera 1.2.2, though Vera 1.2.2 creates roles and answers SimulateCustomPolicy.
Not run in a release build: policy enforcement, access keys, MFA and federation are described from the source review only, and IAM’s behavior across regions wasn’t tested.

API coverage

Every operation in AWS's published 2010-05-08 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. Operations not checked earlier were assessed by a review of the Vera 1.2.0 source on 6 November 2026: source inspection describes an implementation and its known limits, not a successful run in a release build or a comparison with AWS. Failures in a tested build are marked separately, and each note from this review names its evidence and date. What the statuses mean

Operation	Status	Notes
AcceptDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — changes the state, and optional notes, of a local delegation record only. No permissions are delegated, no approval workflow runs and no token is sent. It wasn't run on a release build.
AcquireRole	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — has no implementation of this operation, and a test request against the reviewed source answered HTTP 400 `InvalidAction`. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — a request answered HTTP 400 `InvalidAction`: the action isn't valid for this web service.
AddClientIDToOpenIDConnectProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local OpenID Connect provider and adds a client ID to its list, without duplicates, or removes one. It wasn't run on a release build.
AddRoleToInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — resolves the local instance profile and role and adds the role, enforcing the limit of one role per profile. It wasn't run on a release build.
AddUserToGroup	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — added `docs-user` to `docs-group`, and `GetGroup` then listed it as the group's member. Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and group and adds or removes the membership; removing a membership that doesn't exist returns an error.
AssociateDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — changes the state, and optional notes, of a local delegation record only. No permissions are delegated, no approval workflow runs and no token is sent. It wasn't run on a release build.
AttachGroupPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — resolves the local principal and managed policy, records the attachment and updates the policy's attachment count. AWS managed policies reserved for services are guarded against inappropriate attachment. It wasn't run on a release build.
AttachRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — resolves the local principal and managed policy, records the attachment and updates the policy's attachment count. AWS managed policies reserved for services are guarded against inappropriate attachment. It wasn't run on a release build.
AttachUserPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — resolves the local principal and managed policy, records the attachment and updates the policy's attachment count. AWS managed policies reserved for services are guarded against inappropriate attachment. It wasn't run on a release build.
ChangePassword	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns success without changing anything: neither the old password nor the caller is checked, and the login profile's password stays the same. A test request against the reviewed source left the original password in place. It wasn't run on a release build.
CreateAccessKey	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — creates and stores an access key for a local user, enforces the limit of two keys and returns its secret. Signatures made with the key aren't verified cryptographically. It wasn't run on a release build.
CreateAccountAlias	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — replaces the account's alias list with the supplied alias, even when another alias already exists. It wasn't run on a release build.
CreateDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — creates only a local record with an ID, a description, a `PENDING` state and an empty console link. `OwnerAccountId`, `Permissions` and the workflow, notification and session inputs are dropped, and the stored owner is the local account. It wasn't run on a release build.
CreateGroup	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — created `docs-group`, on a full-access license. A user was then added to it and removed, and the group was deleted. Response fields weren't compared with AWS's.
CreateInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — creates a local instance profile with its path, tags and an empty role list, rejecting duplicate names. It wasn't run on a release build.
CreateLoginProfile	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores a local password, but ignores `PasswordResetRequired` and doesn't enforce the account password policy. A test request against the reviewed source with `PasswordResetRequired` set to `true` read back `false`. It wasn't run on a release build.
CreateOpenIDConnectProvider	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and returns the provider's URL, client IDs and thumbprints, but its `Tags` come back as a list of empty objects. `ListOpenIDConnectProviderTags` returns the tags correctly. It wasn't run on a release build.
CreatePolicy	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores managed policies and their versions, but the policy's `Tags` come back as empty tag objects. `ListPolicyTags` returns the tag values. It wasn't run on a release build. Recorded comparison: earlier check, 3 November 2026 — The returned policy's `Description`, `PermissionsBoundaryUsageCount` and `Tags` differ from AWS's.
CreatePolicyVersion	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates the policy JSON, adds a version, enforces the limit of five versions and makes it the default when asked. AWS managed policies are read-only. It wasn't run on a release build.
CreateRole	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — created a role, on a full-access license, and roles created this way then worked with STS and in other services' role settings. Response fields weren't compared again. Recorded comparison: earlier check, 3 November 2026 — The returned role's `Description` differs from AWS's.
CreateSAMLProvider	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores the supplied name and metadata, but ignores `Tags` and the encryption and private-key options. Its validity date is fixed rather than read from the metadata. It wasn't run on a release build.
CreateServiceLinkedRole	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — creates a local role with a service-linked name, path and trust policy derived from the service. No AWS service is provisioned behind it. It wasn't run on a release build.
CreateServiceSpecificCredential	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — creates a local record with a random credential, but ignores `CredentialAgeDays` and doesn't track expiry. Authentication to the service with it isn't established. It wasn't run on a release build.
CreateUser	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — created `docs-user`, on a full-access license. The user was then added to a group, listed as its member and deleted. Response fields weren't compared with AWS's.
CreateVirtualMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores a virtual device and its seed, but `QRCodePNG` holds random bytes rather than a PNG image, and `Tags` are ignored. Codes aren't validated against the seed. It wasn't run on a release build.
DeactivateMFADevice	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — removes the local user's association with the device and clears the virtual device's assignment details. It wasn't run on a release build.
DeleteAccessKey	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and key and removes the key from the user and the account. It wasn't run on a release build.
DeleteAccountAlias	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — ignores the supplied `AccountAlias` and clears every local alias, even when the requested alias doesn't exist. It wasn't run on a release build.
DeleteAccountPasswordPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads or removes the local password policy, returning an error when there's none. Storing a policy doesn't mean it's enforced. It wasn't run on a release build.
DeleteGroup	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — deleted `docs-group` once its member was removed, on a full-access license.
DeleteGroupPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks the local principal and removes the named inline policy, rejecting a policy that doesn't exist. It wasn't run on a release build.
DeleteInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — removes a local instance profile, and rejects the deletion while a role is still attached. It wasn't run on a release build.
DeleteLoginProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — requires an existing local login profile and clears its password. It wasn't run on a release build.
DeleteOpenIDConnectProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — removes the local OpenID Connect provider with the given ARN. It wasn't run on a release build.
DeletePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — removes a local managed policy, rejecting one that's attached or owned by AWS. Other dependencies, such as use as a permissions boundary, aren't fully checked. It wasn't run on a release build.
DeletePolicyVersion	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes a version that isn't the default, rejects deleting the default and protects AWS managed policies. It wasn't run on a release build.
DeleteRole	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
DeleteRolePermissionsBoundary	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — clears the permissions boundary ARN stored on the user or role. That doesn't establish that boundaries were enforced. It wasn't run on a release build.
DeleteRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks the local principal and removes the named inline policy, rejecting a policy that doesn't exist. It wasn't run on a release build.
DeleteSAMLProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — removes the local SAML provider with the given ARN. It wasn't run on a release build.
DeleteSSHPublicKey	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and SSH key, then removes the key or changes its status. It wasn't run on a release build.
DeleteServerCertificate	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the certificate by name and removes its local record. It wasn't run on a release build.
DeleteServiceLinkedRole	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes the local role at once and returns a random deletion task ID; no deletion task is stored. It wasn't run on a release build.
DeleteServiceSpecificCredential	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes, resets or updates the local credential by its ID, ignoring the `UserName` it belongs to. No credential is configured in the service itself. It wasn't run on a release build.
DeleteSigningCertificate	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — loses the supplied `CertificateId` before the deletion. A test request against the reviewed source to delete a valid uploaded certificate returned `NoSuchEntity` and left the certificate stored. It wasn't run on a release build.
DeleteUser	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — deleted `docs-user` once it was removed from its group, on a full-access license.
DeleteUserPermissionsBoundary	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — clears the permissions boundary ARN stored on the user or role. That doesn't establish that boundaries were enforced. It wasn't run on a release build.
DeleteUserPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks the local principal and removes the named inline policy, rejecting a policy that doesn't exist. It wasn't run on a release build.
DeleteVirtualMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes the local virtual device even while it's assigned, leaving the user associated with a device that no longer exists. It wasn't run on a release build.
DetachGroupPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks that the managed policy is attached, removes it from the local principal and updates the attachment count. It wasn't run on a release build.
DetachRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks that the managed policy is attached, removes it from the local principal and updates the attachment count. It wasn't run on a release build.
DetachUserPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks that the managed policy is attached, removes it from the local principal and updates the attachment count. It wasn't run on a release build.
DisableOrganizationsRootCredentialsManagement	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads local feature flags with a fixed placeholder organization ID. There's no Organizations membership, and no root credential or session behavior, behind them. It wasn't run on a release build.
DisableOrganizationsRootSessions	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads local feature flags with a fixed placeholder organization ID. There's no Organizations membership, and no root credential or session behavior, behind them. It wasn't run on a release build.
DisableOutboundWebIdentityFederation	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads a local enabled flag and a placeholder issuer URL. The setting isn't connected to a JWT issuer or to any federation token behavior. It wasn't run on a release build.
EnableMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — associates the local user and device, but accepts any authentication codes, without validating them as TOTP codes or checking who owns the device. It wasn't run on a release build.
EnableOrganizationsRootCredentialsManagement	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads local feature flags with a fixed placeholder organization ID. There's no Organizations membership, and no root credential or session behavior, behind them. It wasn't run on a release build.
EnableOrganizationsRootSessions	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads local feature flags with a fixed placeholder organization ID. There's no Organizations membership, and no root credential or session behavior, behind them. It wasn't run on a release build.
EnableOutboundWebIdentityFederation	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads a local enabled flag and a placeholder issuer URL. The setting isn't connected to a JWT issuer or to any federation token behavior. It wasn't run on a release build.
GenerateCredentialReport	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lets a later `GetCredentialReport` return a report, but answers with an empty success instead of the report's `State` and `Description`. It wasn't run on a release build.
GenerateOrganizationsAccessReport	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — returned a 24-character job ID, but `GetOrganizationsAccessReport` requires at least 36 characters, so the report can't be read: SDK clients reject the ID, and a direct Query request answered HTTP 400 `ValidationError`. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a random job ID without storing a job or examining any access.
GenerateServiceLastAccessedDetails	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — returned a 24-character job ID, but `GetServiceLastAccessedDetails` and `GetServiceLastAccessedDetailsWithEntities` require at least 36 characters, so the report can't be read: SDK clients reject the ID, and a direct Query request answered HTTP 400 `ValidationError`. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a random job ID without storing a job or examining any access.
GetAccessKeyLastUsed	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the key and user, but the response contains only `UserName`: the stored last-used details don't reach `AccessKeyLastUsed`, and requests aren't recorded as key usage. It wasn't run on a release build.
GetAccountAuthorizationDetails	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — collects the local users, groups, roles and policies, but they don't reach `UserDetailList`, `GroupDetailList`, `RoleDetailList` or `Policies`. A test request against the reviewed source came back empty with users, roles and an attached policy present. Pagination is ignored. It wasn't run on a release build.
GetAccountPasswordPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads or removes the local password policy, returning an error when there's none. Storing a policy doesn't mean it's enforced. It wasn't run on a release build.
GetAccountProperties	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a constant empty `Properties` map; there's no account properties state to write or read. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — a request answered HTTP 200 with an empty `Properties` map.
GetAccountSummary	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — answered HTTP 200 with an empty `SummaryMap`, even with a user, a group and a role present.
GetContextKeysForCustomPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — parses the supplied policies and returns their condition context key names, without duplicates. That doesn't establish full evaluation of policy conditions. It wasn't run on a release build.
GetContextKeysForPrincipalPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — collects the local principal's inline and attached policies, including a user's groups, adds any supplied policies and returns their condition context key names. A missing or unsupported principal returns an error. It wasn't run on a release build.
GetCredentialReport	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — builds a CSV from the local users and their key and MFA state, but omits the report format and `GeneratedTime`. Password change and usage fields, and several rotation, service and region fields, are placeholders or unsupported. It wasn't run on a release build.
GetDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local delegation record, but always reports `NOT_CHECKED`, ignoring `DelegationPermissionCheck`; permissions aren't evaluated. It wasn't run on a release build.
GetGroup	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — after `AddUserToGroup`, returned `docs-group` with `docs-user` as its one member, on a full-access license. Only `Users[].UserName` was checked.
GetGroupPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the named local inline policy document with its principal and policy name; a missing policy returns an IAM error. It wasn't run on a release build.
GetHumanReadableSummary	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — answered HTTP 200 with `COMPLETED` but no summary, even for an entity that doesn't exist. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a fixed completed status, the default or requested locale and an empty summary, without looking up or summarizing the entity.
GetInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the local instance profile's details and the roles attached to it. It wasn't run on a release build.
GetLoginProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the local user's login profile, or an error when there's no profile or password. There's no AWS console sign-in behind it. It wasn't run on a release build.
GetMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the device but echoes the supplied `UserName` without checking ownership, so a different local user is accepted. It wasn't run on a release build.
GetOpenIDConnectProvider	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and returns the provider's URL, client IDs and thumbprints, but its `Tags` come back as a list of empty objects. `ListOpenIDConnectProviderTags` returns the tags correctly. It wasn't run on a release build.
GetOrganizationsAccessReport	Failed in testing	Local observation: Vera 1.2.2, 8 November 2026 — rejected the 24-character job ID that `GenerateOrganizationsAccessReport` returned, since it requires at least 36 characters: SDK clients reject the ID, and a direct Query request answered HTTP 400 `ValidationError`. A report generated in the emulator can't be read. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a completed empty report with current timestamps for any valid job ID, without looking up a stored job or analyzing recorded access. A test request against the reviewed source with an uncreated job ID received one.
GetOutboundWebIdentityFederationInfo	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads a local enabled flag and a placeholder issuer URL. The setting isn't connected to a JWT issuer or to any federation token behavior. It wasn't run on a release build.
GetPolicy	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores managed policies and their versions, but the policy's `Tags` come back as empty tag objects. `ListPolicyTags` returns the tag values. It wasn't run on a release build.
GetPolicyVersion	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the requested version of a local managed policy, with its document, default flag and creation date. It wasn't run on a release build.
GetRole	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
GetRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the named local inline policy document with its principal and policy name; a missing policy returns an IAM error. It wasn't run on a release build.
GetRoleTemplateVersion	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — has no implementation of this operation, and a test request against the reviewed source answered HTTP 400 `InvalidAction`. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — a request answered HTTP 400 `InvalidAction`: the action isn't valid for this web service.
GetSAMLProvider	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the stored metadata with a fixed `ValidUntil` of `2032-05-09T16:27:11Z`; tags added with `TagSAMLProvider`, and the encryption options, aren't returned. It wasn't run on a release build.
GetSSHPublicKey	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the stored key text whatever `Encoding` asks for, so requesting `PEM` for a key uploaded in SSH format still returns the SSH format. It wasn't run on a release build.
GetServerCertificate	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the stored certificate, but mismatched field names leave `ServerCertificate` empty instead of returning its body and metadata. It wasn't run on a release build.
GetServiceLastAccessedDetails	Failed in testing	Local observation: Vera 1.2.2, 8 November 2026 — rejected the 24-character job ID that `GenerateServiceLastAccessedDetails` returned, since it requires at least 36 characters: SDK clients reject the ID, and a direct Query request answered HTTP 400 `ValidationError`. A report generated in the emulator can't be read. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a completed empty report with current timestamps for any valid job ID, without looking up a stored job or analyzing recorded access. A test request against the reviewed source with an uncreated job ID received one.
GetServiceLastAccessedDetailsWithEntities	Failed in testing	Local observation: Vera 1.2.2, 8 November 2026 — rejected the 24-character job ID that `GenerateServiceLastAccessedDetails` returned, since it requires at least 36 characters: SDK clients reject the ID, and a direct Query request answered HTTP 400 `ValidationError`. A report generated in the emulator can't be read. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns a completed empty report with current timestamps for any valid job ID, without looking up a stored job or analyzing recorded access. A test request against the reviewed source with an uncreated job ID received one.
GetServiceLinkedRoleDeletionStatus	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — reported `SUCCEEDED` for a tested deletion. Source inspection: Vera 1.2.0 source, 6 November 2026 — returns `SUCCEEDED` for every task ID, without looking up a task or tracking its progress or failure. A test request against the reviewed source with a task that doesn't exist succeeded.
GetUser	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
GetUserPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the named local inline policy document with its principal and policy name; a missing policy returns an IAM error. It wasn't run on a release build.
ListAccessKeys	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local user's access keys, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListAccountAliases	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the local account alias list, with pagination. It wasn't run on a release build.
ListAttachedGroupPolicies	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local managed policy attachments, with `PathPrefix` filtering and `Marker` and `MaxItems` pagination. A full last page can be followed by an extra empty page. It wasn't run on a release build.
ListAttachedRolePolicies	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local managed policy attachments, with `PathPrefix` filtering and `Marker` and `MaxItems` pagination. A full last page can be followed by an extra empty page. It wasn't run on a release build.
ListAttachedUserPolicies	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local managed policy attachments, with `PathPrefix` filtering and `Marker` and `MaxItems` pagination. A full last page can be followed by an extra empty page. It wasn't run on a release build.
ListDelegationRequests	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns every local delegation record, ignoring the owner filter, `Marker` and `MaxItems`. It wasn't run on a release build.
ListEntitiesForPolicy	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the managed policy's attachments and honors `EntityFilter`, but ignores `PathPrefix`, `PolicyUsageFilter`, `Marker` and `MaxItems`. A policy that doesn't exist or can't be attached is rejected. It wasn't run on a release build.
ListGroupPolicies	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local inline policy names, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListGroups	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
ListGroupsForUser	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the groups that contain the local user, with pagination. It wasn't run on a release build.
ListInstanceProfileTags	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the instance profile's tags, but ignores `Marker` and `MaxItems` and always reports `IsTruncated` as `false`. It wasn't run on a release build.
ListInstanceProfiles	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns every local instance profile, with no `PathPrefix` filtering or pagination. A test request against the reviewed source with `MaxItems` of 1, and a `PathPrefix` that matched one of two profiles, returned both. It wasn't run on a release build.
ListInstanceProfilesForRole	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the local instance profiles the role is attached to, with pagination. It wasn't run on a release build.
ListMFADeviceTags	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads tags for any serial number without checking that the device exists, ignores pagination and always reports `IsTruncated` as `false`. It wasn't run on a release build.
ListMFADevices	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the user's MFA devices, but ignores `Marker` and `MaxItems`. It wasn't run on a release build.
ListOpenIDConnectProviderTags	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local provider's tags, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListOpenIDConnectProviders	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the ARNs of the stored OpenID Connect providers. It wasn't run on a release build.
ListOrganizationsFeatures	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and reads local feature flags with a fixed placeholder organization ID. There's no Organizations membership, and no root credential or session behavior, behind them. It wasn't run on a release build.
ListPolicies	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — filters by scope, attachment and path, and paginates, but ignores `PolicyUsageFilter`, and each policy's `Tags` come back as empty tag objects. It wasn't run on a release build.
ListPoliciesGrantingServiceAccess	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns each requested service namespace with an empty `Policies` list, without inspecting any policy; an attached policy that grants access doesn't change the result. It wasn't run on a release build.
ListPolicyTags	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — returns the local policy's tags, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListPolicyVersions	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the stored policy versions with pagination, including each version's `Document`. It wasn't run on a release build. Recorded comparison: earlier check, 3 November 2026 — Lists each version's `Document`, a member AWS's listing leaves out. Which version is the default matches AWS's.
ListRolePolicies	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local inline policy names, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListRoleTags	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local role's tags, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListRoles	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
ListSAMLProviderTags	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the resource's stored tags, but ignores `Marker` and `MaxItems` and always reports `IsTruncated` as `false`. It wasn't run on a release build.
ListSAMLProviders	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local SAML providers, but their `ValidUntil` is a fixed date rather than one read from the metadata. It wasn't run on a release build.
ListSSHPublicKeys	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the user's stored SSH key details, with pagination. It wasn't run on a release build.
ListServerCertificateTags	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the resource's stored tags, but ignores `Marker` and `MaxItems` and always reports `IsTruncated` as `false`. It wasn't run on a release build.
ListServerCertificates	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists stored certificates with only `Path` and `Arn`: the name, ID and dates are missing, and `PathPrefix`, `Marker` and `MaxItems` are ignored. It wasn't run on a release build.
ListServiceSpecificCredentials	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — filters local credentials by user, by service or for all users, and leaves out their secrets, but ignores `Marker` and `MaxItems`. It wasn't run on a release build.
ListSigningCertificates	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the user's stored signing certificates, with pagination. It wasn't run on a release build.
ListUserPolicies	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the user's inline policy names, but ignores `Marker` and `MaxItems`: a test request against the reviewed source with `MaxItems` of 1 returned two names. It wasn't run on a release build.
ListUserTags	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — reads the local user's tags, with `Marker` and `MaxItems` pagination. It wasn't run on a release build.
ListUsers	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — succeeded in a check that created, read, listed and deleted a user, a group and a role, on a full-access license. Response fields weren't compared with AWS's.
ListVirtualMFADevices	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — lists the local virtual devices, filters by assignment status and applies `Marker` and `MaxItems`. Codes for the devices aren't validated. It wasn't run on a release build.
PutAccountProperties	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — has no implementation of this operation, and a test request against the reviewed source answered HTTP 400 `InvalidAction`. Local observation: Vera 1.2.0-rc.3, 6 November 2026 — a request answered HTTP 400 `InvalidAction`: the action isn't valid for this web service.
PutGroupPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates the policy's JSON syntax and stores it as an inline policy on the existing local principal. How far policies are enforced is described in the page's limitations. It wasn't run on a release build.
PutRolePermissionsBoundary	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and returns the boundary ARN, but doesn't check that the policy exists, and the boundary isn't applied when identity-based policies are enforced. It wasn't run on a release build.
PutRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates the policy's JSON syntax and stores it as an inline policy on the existing local principal. How far policies are enforced is described in the page's limitations. It wasn't run on a release build.
PutUserPermissionsBoundary	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores and returns the boundary ARN, but doesn't check that the policy exists, and the boundary isn't applied when identity-based policies are enforced. It wasn't run on a release build.
PutUserPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates the policy's JSON syntax and stores it as an inline policy on the existing local principal. How far policies are enforced is described in the page's limitations. It wasn't run on a release build.
RejectDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — changes the state, and optional notes, of a local delegation record only. No permissions are delegated, no approval workflow runs and no token is sent. It wasn't run on a release build.
RemoveClientIDFromOpenIDConnectProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local OpenID Connect provider and adds a client ID to its list, without duplicates, or removes one. It wasn't run on a release build.
RemoveRoleFromInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — resolves the instance profile and role and removes the role from the profile. It wasn't run on a release build.
RemoveUserFromGroup	Implemented	Local observation: Vera 1.2.2, 8 November 2026 — removed `docs-user` from `docs-group` before the group and the user were deleted. Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and group and adds or removes the membership; removing a membership that doesn't exist returns an error.
ResetServiceSpecificCredential	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes, resets or updates the local credential by its ID, ignoring the `UserName` it belongs to. No credential is configured in the service itself. It wasn't run on a release build.
ResyncMFADevice	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — only looks up the device: it ignores who owns it and the authentication codes, and changes nothing. A test request against the reviewed source succeeded for a different user with arbitrary codes. It wasn't run on a release build.
SendDelegationToken	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — changes the state, and optional notes, of a local delegation record only. No permissions are delegated, no approval workflow runs and no token is sent. It wasn't run on a release build.
SetDefaultPolicyVersion	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks the requested version of the local policy, makes it the default and protects AWS managed policies. It wasn't run on a release build.
SetSecurityTokenServicePreferences	Not implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores a setting that nothing reads: it changes neither STS tokens nor `GlobalEndpointTokenVersion` in `GetAccountSummary`, which stayed `1` after `v2Token` was set in a test against the reviewed source. It wasn't run on a release build.
SimulateCustomPolicy	Known difference	Local observation: Vera 1.2.2, 8 November 2026 — a simple `Allow` policy returned `allowed`. Source inspection: Vera 1.2.0 source, 6 November 2026 — evaluates the policies against only the first resource ARN, and ignores context entries, permissions boundaries, resource policies, caller and owner inputs and pagination; match and context details are empty. Only `StringEquals` conditions are evaluated; other operators count as satisfied. Recorded comparison: earlier check, 3 November 2026 — Evaluation results differ from AWS's in `EvalDecisionDetails`, `MatchedStatements` and `ResourceSpecificResults`.
SimulatePrincipalPolicy	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — collects the principal's local inline, attached and group policies, but evaluates them against only the first resource ARN and ignores context entries, permissions boundaries, resource policies, caller inputs and pagination. Only `StringEquals` conditions are evaluated; other operators count as satisfied. It wasn't run on a release build.
TagInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local instance profile and adds or removes its stored tags. It wasn't run on a release build.
TagMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — adds or removes tags for any serial number without checking that a device exists. It wasn't run on a release build.
TagOpenIDConnectProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tag keys, finds the local OpenID Connect provider and adds or removes its tags. It wasn't run on a release build.
TagPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tags and adds or removes them on a local managed policy; AWS managed policies are read-only. It wasn't run on a release build.
TagRole	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tags and adds or removes them on a local role. It wasn't run on a release build.
TagSAMLProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks that the local SAML provider exists and adds or removes its tags. It wasn't run on a release build.
TagServerCertificate	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the stored server certificate and adds or removes tags under its ARN. It wasn't run on a release build.
TagUser	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and adds or removes tags stored under its ARN. It wasn't run on a release build.
UntagInstanceProfile	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local instance profile and adds or removes its stored tags. It wasn't run on a release build.
UntagMFADevice	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — adds or removes tags for any serial number without checking that a device exists. It wasn't run on a release build.
UntagOpenIDConnectProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tag keys, finds the local OpenID Connect provider and adds or removes its tags. It wasn't run on a release build.
UntagPolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tags and adds or removes them on a local managed policy; AWS managed policies are read-only. It wasn't run on a release build.
UntagRole	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates tags and adds or removes them on a local role. It wasn't run on a release build.
UntagSAMLProvider	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — checks that the local SAML provider exists and adds or removes its tags. It wasn't run on a release build.
UntagServerCertificate	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the stored server certificate and adds or removes tags under its ARN. It wasn't run on a release build.
UntagUser	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and adds or removes tags stored under its ARN. It wasn't run on a release build.
UpdateAccessKey	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user's key and sets it active or inactive. It wasn't run on a release build.
UpdateAccountPasswordPolicy	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores validated password policy settings, but `CreateLoginProfile` and `UpdateLoginProfile` don't enforce them. It wasn't run on a release build.
UpdateAssumeRolePolicy	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — validates the trust policy JSON and its references to known IAM users and roles, then replaces the local role's trust policy. It wasn't run on a release build.
UpdateDelegationRequest	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — changes the state, and optional notes, of a local delegation record only. No permissions are delegated, no approval workflow runs and no token is sent. It wasn't run on a release build.
UpdateGroup	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — renames a local group and keeps its managed policies attached, but applies `NewPath` only together with `NewGroupName`: a test request against the reviewed source with only `NewPath` succeeded without changing the path. It wasn't run on a release build.
UpdateLoginProfile	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores the password and reset flag without enforcing the password policy. A test request against the reviewed source with only `PasswordResetRequired` cleared the password, and `GetLoginProfile` then found no profile. It wasn't run on a release build.
UpdateOpenIDConnectProviderThumbprint	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — replaces the stored thumbprint list of the local OpenID Connect provider; nothing is fetched from the issuer. It wasn't run on a release build.
UpdateRole	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — resets properties the request leaves out. In test requests against the reviewed source, setting only the description turned a `MaxSessionDuration` of `7200` into `3600` in `GetRole`, and setting only the duration removed the description. It wasn't run on a release build.
UpdateRoleDescription	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local role, replaces its description and returns the updated role. It wasn't run on a release build.
UpdateSAMLProvider	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — replaces the stored SAML metadata only; the encryption and private-key options are ignored and the validity date isn't recalculated. It wasn't run on a release build.
UpdateSSHPublicKey	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — looks up the local user and SSH key, then removes the key or changes its status. It wasn't run on a release build.
UpdateServerCertificate	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — renames or moves the stored certificate, but tags stored under its old ARN don't move to the new one, and the response limits noted for `GetServerCertificate` and `ListServerCertificates` still apply. It wasn't run on a release build.
UpdateServiceSpecificCredential	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — deletes, resets or updates the local credential by its ID, ignoring the `UserName` it belongs to. No credential is configured in the service itself. It wasn't run on a release build.
UpdateSigningCertificate	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — finds the local user's signing certificate and updates its status. It wasn't run on a release build.
UpdateUser	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — renames or moves the local user, but tags stored under the old ARN, and credential ownership, don't move with it. A test request against the reviewed source that renamed a user made its tags disappear. It wasn't run on a release build.
UploadSSHPublicKey	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores any supplied string and computes an MD5 of the text, without parsing or validating the key encoding or computing the standard fingerprint of the decoded key. It wasn't run on a release build.
UploadServerCertificate	Known difference	Source inspection: Vera 1.2.0 source, 6 November 2026 — stores the certificate and key, but ignores `Tags`, returns only `Path` and `Arn` as metadata, with no name, ID, upload date or expiry, and doesn't check that the key matches the certificate. It wasn't run on a release build.
UploadSigningCertificate	Implemented	Source inspection: Vera 1.2.0 source, 6 November 2026 — parses a valid X.509 PEM certificate, enforces the per-user limit and stores a local signing certificate. It wasn't run on a release build.