Example AWS CLI Command to List IAM Roles and Policies

Example AWS CLI Command to List IAM Roles and Policies: A Simple Guide for Beginners

If you're learning about AWS (Amazon Web Services) and the CLI (Command Line Interface), you might come across something called IAM roles and policies. These are really important tools that help you control who can do what in your AWS account. Don't worry if that sounds complicated—let's break it down in a way that even a 12-year-old can understand!

In this post, I'll show you some simple AWS CLI commands to list IAM roles and policies in your AWS account. We’ll explain them step by step, so you can follow along easily. You’ll also find some helpful keywords and common interview questions about IAM roles and policies at the end.

---

What are IAM Roles and Policies?

Imagine you have a toy store, and you need help running it. You might give different people different tasks:

• Some people can open the store.
• Some people can run the cash register.
• Some people can restock the shelves.

Now, think of IAM roles as the people with different jobs, and IAM policies as the instructions that tell them what they are allowed to do.

IAM stands for Identity and Access Management, and it helps AWS users control access to AWS resources.

---

What is AWS CLI?

The AWS CLI (Command Line Interface) is like a special tool you type commands into to control things in your AWS account. Instead of clicking around in a web browser, you can give AWS instructions using commands.

Now, let's learn how to use the AWS CLI to list IAM roles and policies!

---

How to List IAM Roles Using AWS CLI

To list all the IAM roles in your AWS account, use this simple command:

aws iam list-roles

Here’s how it works:

• aws: This is the main AWS command.
• iam: This tells AWS that we want to do something with IAM (the part of AWS that handles roles and policies).
• list-roles: This command asks AWS to show us all the roles.

When you run this command, AWS will show you a list of all the roles in your account. A role is like a worker in your toy store—they have specific tasks they can do.

Example Output:

{
  "Roles": [
    {
      "RoleName": "AdminRole",
      "Arn": "arn:aws:iam::123456789012:role/AdminRole"
    },
    {
      "RoleName": "ReadOnlyRole",
      "Arn": "arn:aws:iam::123456789012:role/ReadOnlyRole"
    }
  ]
}

This means you have two roles: one called AdminRole (maybe this one can do everything) and another called ReadOnlyRole (maybe this one can only look at things without making changes).

---

How to List IAM Policies Using AWS CLI

Next, let's list the policies—these are the instructions or rules that tell the roles what they are allowed to do.

To list all the policies in your account, use this command:

aws iam list-policies

Just like the roles command, this tells AWS to show all the policies in your account.

Example Output:

{
  "Policies": [
    {
      "PolicyName": "S3ReadOnlyPolicy",
      "Arn": "arn:aws:iam::123456789012:policy/S3ReadOnlyPolicy"
    },
    {
      "PolicyName": "AdminAccess",
      "Arn": "arn:aws:iam::123456789012:policy/AdminAccess"
    }
  ]
}

Here, you have two policies:

• S3ReadOnlyPolicy: Maybe this allows someone to look at things in S3 (Amazon’s storage service) but not change anything.
• AdminAccess: This might let someone do anything in the account because they are an "Admin."

---

How to List Attached Policies to a Role

You might also want to know which policies are attached to a specific role. For example, what can your AdminRole do?

To list the policies attached to a role, use this command:

aws iam list-attached-role-policies --role-name AdminRole

This tells AWS to show all the policies connected to the AdminRole.

---

How to List Inline Policies for a Role

Sometimes, roles have custom rules written directly inside them, called inline policies. You can list these using:

aws iam list-role-policies --role-name AdminRole

This will show any special rules that are only attached to the AdminRole and nowhere else.

---

Top 10 Interview Questions About IAM Roles and Policies (with Answers)

1. What is an IAM role in AWS?
   An IAM role in AWS is a set of permissions that define what actions are allowed and denied for a specific identity in your AWS account. Unlike users, roles don't have long-term credentials and are used to delegate access to services and resources.
2. What is the difference between an IAM role and an IAM user?
   An IAM user represents a person or service and has long-term credentials (like access keys and passwords). An IAM role, on the other hand, doesn't have permanent credentials. Instead, it is assumed by users, applications, or services, and provides temporary permissions.
3. How do you attach a policy to an IAM role?
   You can attach a policy to an IAM role using the AWS CLI with the following command:

   aws iam attach-role-policy --role-name <role_name> --policy-arn <policy_arn>

4. What is a managed policy versus an inline policy?
   Managed policies are reusable policies that can be attached to multiple roles, users, or groups. These are either AWS-managed (created by AWS) or customer-managed (created by you). Inline policies, on the other hand, are directly embedded into a specific role, user, or group and are not reusable.
5. How do you check what policies are attached to an IAM role?
   You can check the attached policies of a role using the command:

   aws iam list-attached-role-policies --role-name <role_name>

6. What are the default IAM policies provided by AWS?
   AWS provides several default policies (AWS-managed policies) like AdministratorAccess, ReadOnlyAccess, and PowerUserAccess. These predefined policies allow common levels of access to AWS services without needing to create new policies from scratch.
7. What is the purpose of the IAM policy simulator?
   The IAM Policy Simulator is a tool that allows you to test and troubleshoot IAM policies. You can use it to see the effects of policies and determine what permissions are granted or denied before actually applying them to roles or users.
8. How can you restrict access to specific AWS services for a role?
   You can restrict access by attaching a custom policy to the role that defines the specific actions and services the role can access. For example, to limit access to only Amazon S3, you could create a policy like:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "s3:*",
         "Resource": "*"
       }
     ]
   }

9. What is the difference between a role and a group in AWS IAM?
   An IAM role grants temporary access to AWS resources without requiring long-term credentials and is assumed by users or services. An IAM group is a collection of IAM users that makes it easier to manage permissions for multiple users.
10. Can an IAM role have multiple policies attached?
    Yes, an IAM role can have multiple managed and inline policies attached to it. You can combine multiple policies to define what actions are allowed or denied for the role.

---

Conclusion

Working with AWS CLI and learning to manage IAM roles and policies might seem tough at first, but with practice, it becomes easier. Using simple commands like list-roles and list-policies, you can quickly find out who has access to your AWS resources and what they are allowed to do.

Remember, IAM is all about keeping your AWS account safe and secure, so it’s important to understand who can access what! Hopefully, this guide helped you take the first step in understanding IAM roles and policies.

Let us know if you have any questions, and happy learning!