TheAlanWang

Notes

IAM Permission Cheat Sheet

2 min read

1. Check Current AWS Identity

aws sts get-caller-identity

Use this first to see who you are currently acting as.

2. Check Current AWS CLI Credential/Profile

aws configure list

If profile shows <not set>, AWS CLI is usually using the default profile.

3. List All AWS Profiles

aws configure list-profiles

4. Test a Specific Profile

aws sts get-caller-identity --profile PROFILE_NAME

5. Credential Files

cat ~/.aws/credentials
cat ~/.aws/config

Edit directly if needed:

nano ~/.aws/credentials
nano ~/.aws/config

6. If You Are an IAM User

List attached managed policies:

aws iam list-attached-user-policies --user-name USER_NAME

List inline policies:

aws iam list-user-policies --user-name USER_NAME

List groups:

aws iam list-groups-for-user --user-name USER_NAME

Get one inline policy:

aws iam get-user-policy --user-name USER_NAME --policy-name POLICY_NAME

7. If You Are Using a Role

List attached managed policies:

aws iam list-attached-role-policies --role-name ROLE_NAME

List inline policies:

aws iam list-role-policies --role-name ROLE_NAME

Get one inline policy:

aws iam get-role-policy --role-name ROLE_NAME --policy-name POLICY_NAME

8. Check Group Policies

aws iam list-attached-group-policies --group-name GROUP_NAME
aws iam list-group-policies --group-name GROUP_NAME

9. Inspect a Managed Policy

aws iam get-policy --policy-arn POLICY_ARN
aws iam get-policy-version --policy-arn POLICY_ARN --version-id VERSION_ID

10. Fastest Way to Check a Specific Permission

Use AWS Console:

  1. Open IAM
  2. Open Policy Simulator
  3. Select your user or role
  4. Test actions such as:
    • s3:CreateBucket
    • lambda:CreateFunction
    • cloudformation:CreateStack
    • iam:PassRole

11. Common Permissions for CDK Deploy

  • cloudformation:*
  • s3:*
  • lambda:*
  • dynamodb:*
  • apigateway:*
  • iam:PassRole
  • iam:CreateRole
  • iam:AttachRolePolicy

12. Quick Workflow

aws configure list
aws sts get-caller-identity
aws configure list-profiles

Then:

  • if ARN contains user/, inspect the IAM user
  • if ARN contains assumed-role/, inspect the IAM role
  • if deployment fails, check iam:PassRole first

Graph View