AWS CLI

IAM Commands

Manage AWS identities and permissions. Learn to create users, roles, and policies for secure access control.

6 commands

Pro Tips

Use IAM roles instead of access keys where possible - roles are more secure and auto-rotate.

Use 'aws iam simulate-principal-policy' to test if a user has specific permissions.

Apply least privilege - start with minimal permissions and add as needed.

Common Mistakes

Never commit AWS credentials to git. Use environment variables or AWS profiles.

Overly permissive policies (like *:*) are security risks. Be specific about allowed actions.

Commands

Get caller identity

$ aws sts get-caller-identity

Show current account and user/role info.

List users

$ aws iam list-users --output table

List all IAM users.

List roles

$ aws iam list-roles --query 'Roles[*].[RoleName,Arn]' --output table

List all IAM roles.

Assume role

$ aws sts assume-role --role-arn arn:aws:iam::123:role/name --role-session-name session

Get temporary credentials for role.

List attached policies

$ aws iam list-attached-user-policies --user-name myuser

Show policies attached to user.

Create access key

$ aws iam create-access-key --user-name myuser

Create new access key for user.