Find role being used on server from AWS CLI

user_1700270 0
Viewed 29607

I'm on an EC2 instance that has an IAM role attached to it, and would like to be able to verify that I am indeed using this role from the AWS CLI.

I'm imagining being able to call something like this (but can't find anything like it in the CLI docs):

$ aws get-current-role-details

Does this functionality exist?

amazon-iam amazon-web-services
3 Answers

Use the AWS STS command get-caller-identity.

Returns details about the IAM identity whose credentials are used to call the API.

$ aws sts get-caller-identity
{
    "UserId": "AIDAxxx",
    "Account": "xxx",
    "Arn": "arn:aws:iam::xxx:user/Tyrone321"
}

You can then take the role name, and query IAM for the role details using both iam list-role-policies for inline policies and iam-list-attached-role-policies for attached managed policies (thanks to @Dimitry K for the callout).

$ aws iam list-attached-role-policies --role-name Tyrone321
{
  "AttachedPolicies": [
  {
    "PolicyName": "SomePolicy",
    "PolicyArn": "arn:aws:iam::aws:policy/xxx"
  },
  {
    "PolicyName": "AnotherPolicy",
    "PolicyArn": "arn:aws:iam::aws:policy/xxx"
  } ]
}

To get the actual IAM permissions, use aws iam get-policy to get the default policy version ID, and then aws iam get-policy-version with the version ID to retrieve the actual policy statements. If the IAM principal is a user, the commands are aws iam list-attached-user-policies and aws iam get-user-policy. See the AWS IAM CLI reference for more information.

user_33971140

There is a more simple and elegant way to get the current role details.

$ curl http://169.254.169.254/latest/meta-data/iam/info

{
  "Code" : "Success",
  "LastUpdated" : "2019-05-08T13:15:52Z",
  "InstanceProfileArn" : "arn:aws:iam::xxxxxxxxxxxx:instance-profile/rolename",
  "InstanceProfileId" : "AIPAIFNV5UU4JJLAXXXXX"
}

In InstanceProfileArn you can see your role name

user_64461350

Unfortunately, there is not a simple way to get that information. You'll need to get there through the following path:

Step 1. Get the current EC2 instance ID from the instance metadata.

curl -s http://169.254.169.254/latest/meta-data/instance-id

You may need the current region as well.

curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone/ | sed 's/\(.*\)[a-z]/\1/'

Step 2. Get the ID of the IAM Instance Profile attached to your EC2 instance.

aws ec2 describe-instances \
    --region us-east-1 \
    --instance-id i-12345678 \
    --query 'Reservations[0].Instances[0].IamInstanceProfile.Id'

Remember to substitute the EC2 instance ID and region as required.

Step 3. Get the IAM instance profile roles.

aws iam list-instance-profiles \
    --query "InstanceProfiles[?InstanceProfileId=='ABCDEFG'].Roles"

Remember to substitute the IAM instance profile ID.

Notes:

  • An IAM instance profile may have more than one IAM role associated with it. Usually it will be only one, but it could have more.
user_15744890
Related