AWS IAM documentation change
Summary
Added PowerShell V5 example for Get-IamRole showing role details retrieval and trust policy decoding
Security assessment
Documents how to inspect role trust policies which control privileged access, but does not address a specific vulnerability
Diff
diff --git a/IAM/latest/UserGuide/iam_example_iam_GetRole_section.md b/IAM/latest/UserGuide/iam_example_iam_GetRole_section.md index 22d7e47e6..fefbaa636 100644 --- a//IAM/latest/UserGuide/iam_example_iam_GetRole_section.md +++ b//IAM/latest/UserGuide/iam_example_iam_GetRole_section.md @@ -243,0 +244,38 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: This example returns the details of the`lamda_exec_role`. It includes the trust policy document that specifies who can assume this role. The policy document is URL encoded and can be decoded using the .NET `UrlDecode` method. In this example, the original policy had all white space removed before it was uploaded to the policy. To see the permissions policy documents that determine what someone who assumes the role can do, use the `Get-IAMRolePolicy` for inline policies, and `Get-IAMPolicyVersion` for attached managed policies.** + + + $results = Get-IamRole -RoleName lambda_exec_role + $results | Format-List + + +**Output:** + + + Arn : arn:aws:iam::123456789012:role/lambda_exec_role + AssumeRolePolicyDocument : %7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22 + %3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service + %22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole + %22%7D%5D%7D + CreateDate : 4/2/2015 9:16:11 AM + Path : / + RoleId : 2YBIKAIBHNKB4EXAMPLE1 + RoleName : lambda_exec_role + + + $policy = [System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument) + $policy + + +**Output:** + + + {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]} + + * For API details, see [GetRole](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + +