feat(iam): add key rotation and enhances policy management

[designcode]

Summary

• Implement rotateAccessKey for rotating IAM access keys
• Add attachKeyPolicy, detachKeyPolicy, and listKeyPolicies methods for managing access key policy associations
• Fix pagination markers for list keys and list policies
• Fix getPolicy user output

Test plan

• Run npm test and confirm all tests pass
• Test IAM key rotation flow end-to-end
• Test key-to-policy attach/detach/list operations
• Verify pagination works correctly for keys and policies

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds new IAM client operations for rotating access keys and attaching/detaching/listing policies, and changes pagination marker behavior; these touch credential/policy management flows and could affect permissions if the new endpoints or response parsing are incorrect.

Overview
Adds new IAM SDK surface for access key rotation via rotateAccessKey, returning the rotated key id and newly-issued secret.

Introduces access-key policy association helpers (attachPolicyToAccessKey, detachPolicyFromAccessKey, listPoliciesForAccessKey) and wires new IAM endpoints for these operations.

Fixes pagination handling in listAccessKeys and listPolicies by only sending Marker when a token is provided (instead of defaulting to '0'), and adjusts getPolicy to return attached users as {id, name} objects rather than raw strings.

^{Reviewed by Cursor Bugbot for commit aba9131. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds rotateAccessKey, attachPolicyToAccessKey, detachPolicyFromAccessKey, and listPoliciesForAccessKey to the IAM package, fixes pagination markers in listAccessKeys and listPolicies (removing the erroneous '0' default), and corrects the GetPolicyResponse.users type from string[] to a proper user-object shape.

Two P1 concerns need attention before merging:

• attachPolicyToAccessKey and detachPolicyFromAccessKey accept a parameter named accessKeyId but pass it as UserName to the API — callers who supply the key's UUID id will likely get an API error; the parameter should be renamed to username to match what the IAM user-policy endpoints actually expect.
• rotateAccessKey accesses rotate_access_key_result.id without optional chaining, which will throw a TypeError if the server omits that field on a success response.

Confidence Score: 4/5

Mergeable after addressing the accessKeyId/UserName parameter mismatch and the unsafe property access in rotateAccessKey.

Two P1 findings are present: the misleading parameter name that will cause runtime failures for callers of attachPolicyToAccessKey/detachPolicyFromAccessKey, and the missing optional chain on rotate_access_key_result that can throw unhandled TypeErrors. The pagination fixes and getPolicy type correction are solid improvements.

packages/iam/src/lib/access-key/policy.ts and packages/iam/src/lib/access-key/rotate.ts

Vulnerabilities

No security concerns identified. Credentials are handled via the existing createIAMClient helper, no secrets are hardcoded, and the new endpoints follow the same auth pattern as all other IAM operations.

Important Files Changed

Filename	Overview
packages/iam/src/lib/access-key/policy.ts	New file implementing attach/detach/list policy operations; accessKeyId parameter is sent as UserName to the IAM API, which likely requires the key's username (name), not its UUID id — callers following the parameter name will pass the wrong value.
packages/iam/src/lib/access-key/rotate.ts	New file implementing key rotation; unsafe access on rotate_access_key_result without optional chaining could throw TypeError if server omits the field on a success response.
packages/iam/src/lib/http-client.ts	Adds three new IAM endpoint constants for attach/detach policy and list policies for access key; changes are straightforward and consistent with existing entries.
packages/iam/src/lib/policy/get.ts	Fixes GetPolicyResponse.users from string[] to { id: string; name: string; }[] to match actual API shape; mapping and null-safety look correct.
packages/iam/src/lib/access-key/list.ts	Fixes pagination marker by only appending Marker when a paginationToken is provided, avoiding the erroneous '0' default.
packages/iam/src/lib/policy/list.ts	Same pagination marker fix as list.ts for access keys; change is correct and consistent.
packages/iam/src/index.ts	Exports the three new policy management functions and the rotate function; exports look correct and complete.

_{Reviews (1): Last reviewed commit: "fix(iam): getPolicy user output" | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e1979aa. Configure here.}

[github-actions]

🎉 This PR is included in version 2.1.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 3.1.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀