IAM Commands¶
List and inspect IAM roles and policies, and dump the whole lot to disk for offline review.
audit writes every role and customer-managed policy to a directory as JSON or YAML. That local copy is what makes real review possible - diffing it between runs shows exactly what changed in your permission surface.
Commands¶
iam audit¶
Audit IAM roles and policies, saving them locally.
| Option | Value | Description |
|---|---|---|
--output-dir |
TEXT |
Directory to save audit files (default: ./iam_audit_ |
--include-aws-managed |
flag | Include AWS managed policies in audit (warning: large output) |
--roles-only |
flag | Audit only IAM roles |
--policies-only |
flag | Audit only IAM policies |
--format |
json | yaml |
Output format for saved files (default: json) |
iam list-policies¶
List IAM policies.
| Option | Value | Description |
|---|---|---|
--scope |
All | AWS | Local |
Policy scope to list (default: Local) |
--only-attached |
flag | Only show policies that are attached to users, groups, or roles |
--path-prefix |
TEXT |
Filter policies by path prefix |
iam list-roles¶
List IAM roles with details.
| Option | Value | Description |
|---|---|---|
--path-prefix |
TEXT |
Filter roles by path prefix |
--max-items |
INTEGER |
Maximum number of roles to return (default: 100) |
iam policy-details¶
Get detailed information about a specific IAM policy.
iam role-details¶
Get detailed information about a specific IAM role.
Examples¶
# Roles, optionally filtered by path
aws-cloud-utilities iam list-roles
aws-cloud-utilities iam list-roles --path-prefix /service-role/ --max-items 500
# Customer-managed policies, and only the attached ones
aws-cloud-utilities iam list-policies
aws-cloud-utilities iam list-policies --only-attached
# Include AWS-managed policies (large output)
aws-cloud-utilities iam list-policies --scope All
# Detail for a single role or policy
aws-cloud-utilities iam role-details MyApplicationRole
aws-cloud-utilities iam policy-details arn:aws:iam::123456789012:policy/MyPolicy
# Dump everything to disk
aws-cloud-utilities iam audit --output-dir ./iam-audit
# Roles only, as YAML
aws-cloud-utilities iam audit --roles-only --format yaml
Notes¶
--include-aws-managed on audit pulls in every AWS-managed policy document. That is hundreds of
files and rarely what you want; customer-managed policies are where your risk lives.
--roles-only and --policies-only are mutually exclusive in practice - passing both narrows the
audit to nothing useful.
Diffing an audit between runs¶
aws-cloud-utilities iam audit --output-dir ./iam-$(date +%Y%m%d)
diff -r ./iam-20260701 ./iam-20260801
Related¶
- Security Commands - GuardDuty and Security Hub metrics
- AWS Config Commands - rule-based compliance state
- Account Commands - validate which permissions your caller actually has