--- title: "AWS IAM Enumeration CLI Commands - Cybr" description: "A reference of AWS CLI commands for enumerating IAM users, groups, roles, and policies, with the permission each command needs." url: https://cybr.com/cloud-security/aws-iam-enumeration/ --- # AWS IAM Enumeration CLI Commands A reference of AWS CLI commands for enumerating IAM users, groups, roles, and policies, with the permission each command needs. Christophe Published February 7, 2024 · Updated October 27, 2026 Enumeration is usually the first thing an attacker (or a pentester) does with a set of AWS credentials: figure out who they are, and what IAM users, groups, roles, and policies exist in the account. Defenders should know these commands too, both to audit their own accounts and to recognize enumeration when it shows up in CloudTrail. This post is a reference of the AWS CLI commands for IAM enumeration. For what users, groups, roles, and policies are, start with [What Is AWS IAM?](https://cybr.com/cloud-security/what-is-aws-iam/#iam-policies) ## AWS IAM enumeration CLI commands These commands retrieve general account information, including IAM users, groups, roles, and policies, and their relationships to one another. These are meant to be non-destructive enumeration commands. They only retrieve information, they do not modify resources (unless otherwise specified). [Official AWS Documentation](https://docs.aws.amazon.com/cli/latest/reference/iam/) Note: most of these commands have many more options than are shown, but they are optional and left out because they're not that useful most of the time and only required for special use cases. Refer to the docs above for more details. Legend: - Each line that starts with `aws` is the command - The word immediately following `aws` denotes the service (ie: `aws sts` is calling the [STS](https://docs.aws.amazon.com/cli/latest/reference/sts/) service, `aws iam` is calling the [IAM](https://docs.aws.amazon.com/cli/latest/reference/iam/) service) ## General commands ### Get-caller-identity ``` aws sts get-caller-identity ``` Example output: ``` { "UserId": "AIDAT6ZKEI3E3J2XL4E5B", "Account": "921234892411", "Arn": "arn:aws:iam::921234892411:user/sm-enumeration-Julie" } ``` `:user/` in the ARN tells us this is a user identity and not a role. A role session would show `:assumed-role/` instead. The "whoami" in AWS. Returns details about the IAM user or role whose credentials are used to call the operation. While not an IAM command (it's an STS command), this is often the first command that gets used for IAM enumeration which is why it's included here. No permissions are required to call this command, and even an explicit deny can't block it, because AWS returns the same information in the error when access is denied. [More on that here](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html). ### Get-access-key-info ``` aws sts get-access-key-info --access-key-id ``` Provide the AWS account ID for the given access key ID. Only provide the access key ID, not the secret access key. Note: if an access key ID starts with `AKIA`, then it means it's a long-term credential. If it starts with `ASIA`, then it means they are temporary credentials that were created by STS operations ### Get-account-authorization-details ``` aws iam get-account-authorization-details ``` General IAM account information Gives a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) and their relationships in your account. ## User Enumeration ### List-users ``` aws iam list-users ``` List users in the AWS account. ### List-Service-specific-credentials ``` aws iam list-service-specific-credentials [--user-name ] [--service-name ] [--all-users] ``` Lists service-specific credentials: CodeCommit Git credentials, Amazon Keyspaces passwords, and long-term API keys for services such as Amazon Bedrock. Without `--user-name`, it uses the caller. With `--all-users` (and `--service-name`), it lists credentials for every user in the account. ### Get-user ``` aws iam get-user --user-name ``` Get user's metadata. Includes permissions boundaries! ### List-access-keys ``` aws iam list-access-keys [--user-name ] ``` List existing access keys for a specific user (your current user being the default if no value is specified) ### List-user-policies ``` aws iam list-user-policies --user-name ``` Get inline policies for a user. ### Get-user-policy ``` aws iam get-user-policy --user-name --policy-name ``` Get details about an inline policy. ### List-attached-user-policies ``` aws iam list-attached-user-policies --user-name ``` Get attached (managed) policies (instead of inline policies). These can be either AWS-managed or Customer-managed policies. ### Get-login-profile ``` aws iam get-login-profile [--user-name ] ``` Checks whether the user has a console password (a "login profile"). Returns `UserName`, `CreateDate` (when the password was first created), and `PasswordResetRequired`. If the user has no console password, it returns a `NoSuchEntity` error, which is itself useful information. ## Groups Enumeration ### List-groups ``` aws iam list-groups ``` Get a list of groups in the AWS account. ### List-groups-for-user ``` aws iam list-groups-for-user --user-name ``` Get groups related to a user. ### Get-group ``` aws iam get-group --group-name ``` Get a group's details. ### List-group-policies ``` aws iam list-group-policies --group-name ``` Get inline policies of a group. ### Get-group-policy ``` aws iam get-group-policy --group-name --policy-name ``` Get the policy document for a specific inline policy embedded in a group. ([The difference between inline and managed policies](https://cybr.com/cloud-security/what-is-aws-iam/#iam-policies)) ### List-attached-group-policies ``` aws iam list-attached-group-policies --group-name ``` Get attached (managed) policies for a group (instead of inline policies). These can be either AWS-managed or Customer-managed policies. ([Inline vs. managed, and AWS-managed vs. Customer-managed policies](https://cybr.com/cloud-security/what-is-aws-iam/#iam-policies)) ## Enumerate Roles ### List-roles ``` aws iam list-roles ``` Get roles in the AWS account. ### Get-role ``` aws iam get-role --role-name ``` Get details about a specific role. ### List-role-policies ``` aws iam list-role-policies --role-name ``` Get inline policies of a role. ([Inline vs. managed policies](https://cybr.com/cloud-security/what-is-aws-iam/#iam-policies)) ### Get-role-policy ``` aws iam get-role-policy --role-name --policy-name ``` Get inline policy details. ### List-attached-role-policies ``` aws iam list-attached-role-policies --role-name ``` Get attached (managed) policies for a role (instead of inline policies). These can be either AWS-managed or Customer-managed policies ## Enumerate policies ### List-policies ``` aws iam list-policies [--only-attached] [--scope Local] ``` List policies \[--only-attached\] is optional and will list policies only if they're attached to an IAM user/group/role \[--scope local\]`is optional and will only list policies that are Customer-managed, not AWS-managed.`\--scope\` AWS would be the opposite ### List-policies-granting-service-access ``` aws iam list-policies-granting-service-access --arn --service-namespaces ``` Get a list of the policies that give a user, group, or role access to a specific service. Only identity-based policies are considered: resource policies, SCPs and RCPs, and permissions boundaries can still allow or block access, so treat the result as a starting point. Example: `aws iam list-policies-granting-service-access --arn arn:aws:iam::123456789012:user/UserName --service-namespaces eks` for EKS ### Get-policy ``` aws iam get-policy --policy-arn ``` Get details for a specific policy. ### List-policy-versions ``` aws iam list-policy-versions --policy-arn ``` Returns information about policy versions for a specific managed policy, including which one is the current default version. ### Get-policy-version ``` aws iam get-policy-version --policy-arn --version-id ``` Get details for a specific policy version since policies can have multiple versions. ### List-entities-for-policy ``` aws iam list-entities-for-policy --policy-arn ``` Lists all the IAM users/groups/roles that the managed policy is attached to. ## MFA ### List-mfa-devices ``` aws iam list-mfa-devices [--user-name ] ``` Get list of all MFA devices for a specific user. If no user is provided, AWS auto determines the user based on the access key ID. ### List-virtual-mfa-devices ``` aws iam list-virtual-mfa-devices [--assignment-status ] ``` Get a list of all virtual MFA devices in the AWS account. Hardware and FIDO security key (passkey) devices aren't included; use `list-mfa-devices` per user for those. Can use optional `--assignment-status` to filter by Assigned, Unassigned, or Any (the default) ## Learn how to enumerate IAM hands-on Practice these commands in a real AWS environment with our free [Introduction to AWS IAM Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) lab. When you're ready for what comes next, see [AWS IAM privilege escalation techniques](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/). ## Helpful tools - [enumerate-iam](https://github.com/andresriancho/enumerate-iam) - Enumerates the permissions associated with a set of AWS credentials by trying API calls. It hasn't been updated since 2024, so its list of API calls misses newer services and actions. More in our list of [open-source AWS pentesting tools](https://cybr.com/cloud-security/open-source-aws-security-tools/#pentesting). ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [Red Team](https://cybr.com/red-team/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [IAM](https://cybr.com/tag/iam/) - [Pentesting](https://cybr.com/tag/pentesting/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)