This assumes you have already configured the aws command line tool. If not, check out my article on Getting Started with the AWS CLI.

• An IAM Policy allows certain actions (such create) on certain resources (such as EC2)
• An IAM User is typically a users account (such as john.doe) that contains an IAM Identity-Based Policy that allows certain actions (such as list) on certain resources (such S3)
• An IAM Role contains an IAM Policy that allows certain actions (such create) on certain resources (such as EC2). Let's say the Identity-Based Policy attached to john.doe does NOT allow "create S3"
  • The Role that allows "create S3" could be attached to john.doe - or, john.doe could Assume the Role:
    • Assume Role or Switch Role using Python boto3
    • Assume Role or Switch Role using Terraform
    • Assume Role or Switch Role using the AWS CLI
  • Often, a Role will have two Policies:
    • Trust Relationship
    • Permission Policy

The aws iam list-users command can be used to list the IAM users that have been created.

~]$ aws iam list-users
{
    "Users": [
        {
            "Path": "/",
            "UserName": "john.doe",
            "UserId": "AIDAABCDL76GLUA6B21234",
            "Arn": "arn:aws:iam::123456789012:user/john.doe",
            "CreateDate": "2022-09-13T11:13:03+00:00"
        }
    ]
}

• The aws iam list-user-policies command should list the policies that have been embedded to a user. These are NOT managed policies that can be attached to two or more user accounts. Instead, this is a specific policy that is only associated with the specified user.
• The aws iam list-attached-user-policies command should list the managed policies that have been attached to a user
• The aws iam list-attached-role-policies command should list the managed policies that have been attached to a role

In this example, the AdministratorAccess policy is attached to user john.doe.

~]$ aws iam list-attached-user-policies --user-name john.doe
{
    "AttachedPolicies": [
        {
            "PolicyName": "AdministratorAccess",
            "PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
        }
    ]
}

In this example, user velero has an embedded policy named velero-s3.

~]$ aws iam list-user-policies --user-name velero
{
    "PolicyNames": [
        "velero-s3"
    ]
}