Enumeration is usually the first thing an attacker (or a pentester) does with a set of AWS credentials: figure out who they are, and what IAM users, groups, roles, and policies exist in the account. Defenders should know these commands too, both to audit their own accounts and to recognize enumeration when it shows up in CloudTrail.

This post is a reference of the AWS CLI commands for IAM enumeration. For what users, groups, roles, and policies are, start with What Is AWS IAM?

AWS IAM enumeration CLI commands

These commands retrieve general account information, including IAM users, groups, roles, and policies, and their relationships to one another.

These are meant to be non-destructive enumeration commands. They only retrieve information, they do not modify resources (unless otherwise specified). Official AWS Documentation

Note: most of these commands have many more options than are shown, but they are optional and left out because they're not that useful most of the time and only required for special use cases. Refer to the docs above for more details.

Legend:

  • Each line that starts with aws is the command
  • The word immediately following aws denotes the service (ie: aws sts is calling the STS service, aws iam is calling the IAM service)

General commands

Get-caller-identity

aws sts get-caller-identity

Example output:

{
    "UserId": "AIDAT6ZKEI3E3J2XL4E5B",
    "Account": "921234892411",
    "Arn": "arn:aws:iam::921234892411:user/sm-enumeration-Julie"
}

:user/ in the ARN tells us this is a user identity and not a role. A role session would show :assumed-role/ instead.

The "whoami" in AWS.

Returns details about the IAM user or role whose credentials are used to call the operation. While not an IAM command (it's an STS command), this is often the first command that gets used for IAM enumeration which is why it's included here.

No permissions are required to call this command, and even an explicit deny can't block it, because AWS returns the same information in the error when access is denied. More on that here.

Get-access-key-info

aws sts get-access-key-info --access-key-id <value>

Provide the AWS account ID for the given access key ID. Only provide the access key ID, not the secret access key.

Note: if an access key ID starts with AKIA, then it means it's a long-term credential. If it starts with ASIA, then it means they are temporary credentials that were created by STS operations

Get-account-authorization-details

aws iam get-account-authorization-details

General IAM account information

Gives a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) and their relationships in your account.

User Enumeration

List-users

aws iam list-users

List users in the AWS account.

List-Service-specific-credentials

aws iam list-service-specific-credentials [--user-name <username>] [--service-name <svc>] [--all-users]

Lists service-specific credentials: CodeCommit Git credentials, Amazon Keyspaces passwords, and long-term API keys for services such as Amazon Bedrock. Without --user-name, it uses the caller. With --all-users (and --service-name), it lists credentials for every user in the account.

Get-user

aws iam get-user --user-name <username>

Get user's metadata. Includes permissions boundaries!

List-access-keys

aws iam list-access-keys [--user-name <value>]

List existing access keys for a specific user (your current user being the default if no value is specified)

List-user-policies

aws iam list-user-policies --user-name <username>

Get inline policies for a user.

Get-user-policy

aws iam get-user-policy --user-name <username> --policy-name <policyname>

Get details about an inline policy.

List-attached-user-policies

aws iam list-attached-user-policies --user-name <username>

Get attached (managed) policies (instead of inline policies). These can be either AWS-managed or Customer-managed policies.

Get-login-profile

aws iam get-login-profile [--user-name <username>]

Checks whether the user has a console password (a "login profile"). Returns UserName, CreateDate (when the password was first created), and PasswordResetRequired. If the user has no console password, it returns a NoSuchEntity error, which is itself useful information.

Groups Enumeration

List-groups

aws iam list-groups

Get a list of groups in the AWS account.

List-groups-for-user

aws iam list-groups-for-user --user-name <username>

Get groups related to a user.

Get-group

aws iam get-group --group-name <name>

Get a group's details.

List-group-policies

aws iam list-group-policies --group-name <groupname>

Get inline policies of a group.

Get-group-policy

aws iam get-group-policy --group-name <groupname> --policy-name <policyname>

Get the policy document for a specific inline policy embedded in a group. (The difference between inline and managed policies)

List-attached-group-policies

aws iam list-attached-group-policies --group-name <name>

Get attached (managed) policies for a group (instead of inline policies). These can be either AWS-managed or Customer-managed policies. (Inline vs. managed, and AWS-managed vs. Customer-managed policies)

Enumerate Roles

List-roles

aws iam list-roles

Get roles in the AWS account.

Get-role

aws iam get-role --role-name <role-name>

Get details about a specific role.

List-role-policies

aws iam list-role-policies --role-name <name>

Get inline policies of a role. (Inline vs. managed policies)

Get-role-policy

aws iam get-role-policy --role-name <name> --policy-name <name>

Get inline policy details.

List-attached-role-policies

aws iam list-attached-role-policies --role-name <role-name>

Get attached (managed) policies for a role (instead of inline policies). These can be either AWS-managed or Customer-managed policies

Enumerate policies

List-policies

aws iam list-policies [--only-attached] [--scope Local]

List policies [--only-attached] is optional and will list policies only if they're attached to an IAM user/group/role

[--scope local]is optional and will only list policies that are Customer-managed, not AWS-managed.--scope` AWS would be the opposite

List-policies-granting-service-access

aws iam list-policies-granting-service-access --arn <identity> --service-namespaces <svc>

Get a list of the policies that give a user, group, or role access to a specific service. Only identity-based policies are considered: resource policies, SCPs and RCPs, and permissions boundaries can still allow or block access, so treat the result as a starting point.

Example: aws iam list-policies-granting-service-access --arn arn:aws:iam::123456789012:user/UserName --service-namespaces eks for EKS

Get-policy

aws iam get-policy --policy-arn <policy_arn>

Get details for a specific policy.

List-policy-versions

aws iam list-policy-versions --policy-arn <arn>

Returns information about policy versions for a specific managed policy, including which one is the current default version.

Get-policy-version

aws iam get-policy-version --policy-arn <arn:aws:iam::123456789012:policy/example-policy> --version-id <v1 or v2 or ...>

Get details for a specific policy version since policies can have multiple versions.

List-entities-for-policy

aws iam list-entities-for-policy --policy-arn <value>

Lists all the IAM users/groups/roles that the managed policy is attached to.

MFA

List-mfa-devices

aws iam list-mfa-devices [--user-name <username>]

Get list of all MFA devices for a specific user. If no user is provided, AWS auto determines the user based on the access key ID.

List-virtual-mfa-devices

aws iam list-virtual-mfa-devices [--assignment-status <value>]

Get a list of all virtual MFA devices in the AWS account. Hardware and FIDO security key (passkey) devices aren't included; use list-mfa-devices per user for those.

Can use optional --assignment-status to filter by Assigned, Unassigned, or Any (the default)

Learn how to enumerate IAM hands-on

Practice these commands in a real AWS environment with our free Introduction to AWS IAM Enumeration lab. When you're ready for what comes next, see AWS IAM privilege escalation techniques.

Helpful tools

  • enumerate-iam - Enumerates the permissions associated with a set of AWS credentials by trying API calls. It hasn't been updated since 2024, so its list of API calls misses newer services and actions.

More in our list of open-source AWS pentesting tools.