Awsflow IAM

Inspect IAM roles, policies, users, groups, simulate permissions, and audit credentials.

When to Use This Skill

Use this skill when the user:

• Asks about IAM roles, policies, or permissions
• Wants to inspect what a role or user can access
• Needs to simulate permissions with SimulatePrincipalPolicy
• Wants to audit users, access keys, MFA devices
• Asks about credential reports or account settings
• Needs to check attached or inline policies

Tool: IAMTool

Execute AWS IAM commands including permission simulation. ALWAYS provide params object.

Commands

ListRoles

List IAM roles.

{ "command": "ListRoles", "params": { "MaxItems": 100 } }

Parameters:

GetRole

Get details of an IAM role.

{ "command": "GetRole", "params": { "RoleName": "my-role" } }

Parameters:

GetRolePolicy

Get an inline policy attached to a role.

{ "command": "GetRolePolicy", "params": { "RoleName": "my-role", "PolicyName": "my-inline-policy" } }

Parameters:

ListRolePolicies

List inline policy names for a role.

{ "command": "ListRolePolicies", "params": { "RoleName": "my-role" } }

Parameters:

ListAttachedRolePolicies

List managed policies attached to a role.

{ "command": "ListAttachedRolePolicies", "params": { "RoleName": "my-role" } }

Parameters:

ListRoleTags

List tags attached to a role.

{ "command": "ListRoleTags", "params": { "RoleName": "my-role" } }

Parameters:

ListPolicies

List IAM policies.

{ "command": "ListPolicies", "params": { "Scope": "Local", "OnlyAttached": true } }

Parameters:

GetPolicy

Get details of a managed policy.

{ "command": "GetPolicy", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy" } }

Parameters:

GetPolicyVersion

Get a specific version of a policy document.

{ "command": "GetPolicyVersion", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy", "VersionId": "v1" } }

Parameters:

ListPolicyVersions

List all versions of a managed policy.

{ "command": "ListPolicyVersions", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy" } }

Parameters:

ListUsers

List IAM users.

{ "command": "ListUsers", "params": {} }

Parameters:

GetUser

Get details of an IAM user.

{ "command": "GetUser", "params": { "UserName": "john" } }

Parameters:

ListAccessKeys

List access keys for a user.

{ "command": "ListAccessKeys", "params": { "UserName": "john" } }

Parameters:

ListMFADevices

List MFA devices for a user.

{ "command": "ListMFADevices", "params": { "UserName": "john" } }

Parameters:

ListGroups

List IAM groups.

{ "command": "ListGroups", "params": {} }

Parameters:

GetAccountSummary

Get IAM account summary (resource counts and limits).

{ "command": "GetAccountSummary", "params": {} }

Parameters: None required.

GetAccountPasswordPolicy

Get the account password policy.

{ "command": "GetAccountPasswordPolicy", "params": {} }

Parameters: None required.

GenerateCredentialReport

Generate a credential report (async — poll with GetCredentialReport).

{ "command": "GenerateCredentialReport", "params": {} }

Parameters: None required.

GetCredentialReport

Get the most recently generated credential report.

{ "command": "GetCredentialReport", "params": {} }

Parameters: None required.

GetServiceLastAccessedDetails

Get last accessed details for services by an IAM entity.

{ "command": "GetServiceLastAccessedDetails", "params": { "JobId": "12345678-1234-1234-1234-123456789012" } }

Parameters:

SimulatePrincipalPolicy

Simulate IAM policy evaluation — test what a role/user can access.

{
  "command": "SimulatePrincipalPolicy",
  "params": {
    "PolicySourceArn": "arn:aws:iam::123456789012:role/MyRole",
    "ActionNames": ["s3:GetObject", "s3:PutObject"],
    "ResourceArns": ["arn:aws:s3:::my-bucket/*"]
  }
}

Parameters:

Related Services

• IAM → All Services: IAM roles and policies control access to every AWS service. Key services using IAM roles:
  • Lambda: Execution roles (check GetFunctionConfiguration → Role)
  • EC2: Instance profiles
  • Glue: Job execution roles
  • Step Functions: State machine execution roles
  • ECS: Task execution roles and task roles
• IAM → STS: Use STSTool GetCallerIdentity to verify current identity, AssumeRole to switch roles
• IAM → CloudTrail → CloudWatch: IAM API calls logged in CloudTrail. Use CloudWatchLogTool to search CloudTrail log groups
• IAM → CloudFormation: IAM resources managed by CloudFormation stacks