AWS Find all groups/users that have access to a specific role - amazon-iam

Question

If I have a role named OperationAdmins which grants the AdministratorAccess Policy to anyone that assumes the role, how can I find a list of all users or groups that can assume the OperationAdmins role?

Answer 1

Just to give you an example, and you can customize it to fit your own needs. You can use the IAM policy simulator API to achieve this.
import boto3
iamc = boto3.client('iam')
iamr = boto3.resource('iam')
iam_paginator = iamc.get_paginator('list_users')
iam_page_iterator = iam_paginator.paginate()
operation_admins_iam_role = iamr.Role('OperationAdmins')
operation_admins_iam_role_arn = operation_admins_iam_role.arn
for page in iam_page_iterator:
users = page['Users']
for user in users:
user_arn = user['Arn']
resp = iamc.simulate_principal_policy(
PolicySourceArn=user_arn,
ActionNames=['sts:AssumeRole'],
ResourceArns=[operation_admins_iam_role_arn]
)
decision = resp['EvaluationResults'][0]['EvalDecision']
print(user_arn, decision)

Answer 2

There are two sides to trust.
The identity asking to assume
The identity allowing the assume
(Asker) Users/Groups can have permissions. The important one being sts:AssumeRole.
(Allowing) In your case OperationAdmins role. They will have a trust relationship which defines who is allowed to assume itself.
Read more: https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/
This trust relationship Allow anyone in account 111122223333 and with permissions sts:AssumeRole to assume it.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}
This trust relationship Allow user LiJuan if he has sts:AssumeRole permissions.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/LiJuan"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}