# Create IAM user

Canonical URL: https://docs.fuse.init.inc/integrations/aws/actions/iam.users.create

Create an IAM user with a required permissions boundary and optional path/tags. Never creates a password or access key. Requires iam:CreateUser and iam:TagUser. Unsafe because CreateUser is not replay-idempotent.

Action ID: `iam.users.create`
Provider: AWS (`aws`)
Contract version: 1

## Risk and exposure

- Risk: Write
- Idempotency: Unsafe — Retries may duplicate side effects; callers must coordinate carefully.
- Availability: Default
- Exposure: REST, SDK
- MCP hints: readOnly=false, destructive=false, idempotent=false, openWorld=true

## Required scopes

- `iam:CreateUser`
- `iam:TagUser`

## Input schema fields

- `user_name`
- `permissions_boundary_arn`
- `path`
- `tags`
- `tags[]`
- `tags[].key`
- `tags[].value`

## Output schema fields

- `user`
- `user.name`
- `user.id`
- `user.arn`
- `user.path`
- `user.created_at`
- `user.password_last_used_at`
- `user.permissions_boundary_arn`
- `user.tags`
- `user.tags[]`
- `user.tags[].key`
- `user.tags[].value`

Provider overview: https://docs.fuse.init.inc/integrations/aws
Actions index: https://docs.fuse.init.inc/integrations/aws/actions
Exact canonical JSON contract: https://docs.fuse.init.inc/api/catalog/v1/providers/aws/actions/iam.users.create
Deployment-effective discovery: https://api.fuse.init.inc/v1/tenants/%7Btenant_id%7D/providers/aws/actions