Skip to content

IAM Commands

List and inspect IAM roles and policies, and dump the whole lot to disk for offline review.

audit writes every role and customer-managed policy to a directory as JSON or YAML. That local copy is what makes real review possible - diffing it between runs shows exactly what changed in your permission surface.

Commands

iam audit

Audit IAM roles and policies, saving them locally.

aws-cloud-utilities iam audit [OPTIONS]
Option Value Description
--output-dir TEXT Directory to save audit files (default: ./iam_audit__)
--include-aws-managed flag Include AWS managed policies in audit (warning: large output)
--roles-only flag Audit only IAM roles
--policies-only flag Audit only IAM policies
--format json | yaml Output format for saved files (default: json)

iam list-policies

List IAM policies.

aws-cloud-utilities iam list-policies [OPTIONS]
Option Value Description
--scope All | AWS | Local Policy scope to list (default: Local)
--only-attached flag Only show policies that are attached to users, groups, or roles
--path-prefix TEXT Filter policies by path prefix

iam list-roles

List IAM roles with details.

aws-cloud-utilities iam list-roles [OPTIONS]
Option Value Description
--path-prefix TEXT Filter roles by path prefix
--max-items INTEGER Maximum number of roles to return (default: 100)

iam policy-details

Get detailed information about a specific IAM policy.

aws-cloud-utilities iam policy-details POLICY_ARN

iam role-details

Get detailed information about a specific IAM role.

aws-cloud-utilities iam role-details ROLE_NAME

Examples

# Roles, optionally filtered by path
aws-cloud-utilities iam list-roles
aws-cloud-utilities iam list-roles --path-prefix /service-role/ --max-items 500

# Customer-managed policies, and only the attached ones
aws-cloud-utilities iam list-policies
aws-cloud-utilities iam list-policies --only-attached

# Include AWS-managed policies (large output)
aws-cloud-utilities iam list-policies --scope All

# Detail for a single role or policy
aws-cloud-utilities iam role-details MyApplicationRole
aws-cloud-utilities iam policy-details arn:aws:iam::123456789012:policy/MyPolicy

# Dump everything to disk
aws-cloud-utilities iam audit --output-dir ./iam-audit

# Roles only, as YAML
aws-cloud-utilities iam audit --roles-only --format yaml

Notes

--include-aws-managed on audit pulls in every AWS-managed policy document. That is hundreds of files and rarely what you want; customer-managed policies are where your risk lives.

--roles-only and --policies-only are mutually exclusive in practice - passing both narrows the audit to nothing useful.

Diffing an audit between runs

aws-cloud-utilities iam audit --output-dir ./iam-$(date +%Y%m%d)
diff -r ./iam-20260701 ./iam-20260801